One of the first things I look at when starting with a brand is its access structure, and the picture is usually this: the Meta password sits in a former agency's inbox, three ex-employees' personal Gmails are admins on Google Ads, the Instagram password lives in a WhatsApp group, and the actual owner of the ad account is... unclear. This article proposes the same routine to both sides of the relationship — because the same neglect burns both.
The most critical rule first: the brand must own the assets
This comes before even password hygiene. The ad account, pixel/dataset, Instagram-Facebook assets, Google Ads account, GA4 property, Tag Manager container, Merchant Center — all of them must be owned by the brand's own Business Manager / corporate Google account, with the agency granted partner access only. The saddest scenario I meet in the field: the ad account was created inside the agency's BM, years of data and learning accumulated there, and when the relationship ended the brand had to start from zero. Pixel history, conversion data, quality scores — none of it transfers. Even with a well-meaning agency, this setup leaves the brand hostage. The rule is simple: regardless of who pays, the asset lives in the BM of whoever's business it belongs to.
Correct onboarding: the same pattern on four platforms
Meta: the brand sets up its own Business Manager/portfolio (if it doesn't exist, creating it is the agency's first task for the brand). The agency sends a partner request from its own BM; the brand chooses which asset to share at which level. Nobody tells anybody a password; agency staff work through their own logins via the agency's BM. Google Ads: the agency's MCC (manager account) sends a link request to the brand's account; the brand accepts. Admin invitations go to corporate addresses, never personal Gmails. GA4 / Tag Manager: ownership on the corporate Google account, editor roles for the agency. Instagram specifically: once the account is connected to the Meta portfolio, posting and comment management run through scheduling tools and Business Suite — the app password never needs to circulate on agency phones; I covered the account-security dimension in the Instagram prevention guide.
Permission levels: to each exactly their job
The second common mistake is knowing only one access level: full admin. A media buyer needs ad management; a reporting analyst needs view access; the finance person needs the billing role. Full admin — adding/removing users, deleting assets — should rest with one, at most two people on the brand side. This isn't ceremonial rigour; it's practical insurance: an accidentally deleted conversion action is the most innocent outcome of admin rights granted to the wrong person.
Offboarding: the structure should survive the breakup
In a correctly built setup, changing agencies is a half-hour task: remove the partner link, unlink the MCC, delete the GA4/GTM roles — assets, data and history stay with the brand. In a wrongly built one, weeks of "access archaeology" begin: who has which password, which account was opened under whose email, does the old agency still reply... A 15-minute quarterly access audit — reviewing the "who has access?" list on every platform — makes that archaeology unnecessary. Every departing employee and every ended agency relationship is removed from the access lists the same day.
In short: the correct meaning of "give them access" is never sending passwords; it's the agency connecting to brand-owned assets with its corporate identity, role by role. This structure costs an hour at setup; its absence can cost the brand its entire advertising history on the tensest day of the relationship.