How access levels work
Access in Google Ads is granted to a person, for a whole account, at one of a small set of levels. Admin can do everything, including changing billing and inviting or removing other users. Standard can edit campaigns, budgets and ads but cannot manage people. Read only can look at everything and export reports without changing anything. Email only receives scheduled reports and notifications and cannot sign in at all.
Access is attached to a person’s Google account, not to their job. Removing someone from your company email system does not remove their access to your advertising, and neither does ending a contract. Agencies more often connect through a manager account, which links to the client account and manages permissions from above — that arrangement keeps the business as the owner rather than the guest. Meta Ads works through Business Manager with a similar split between full control and analyst-style viewing.
Why access levels matter
This is the cheapest security control you have, and the one most often skipped. Billing sits behind admin, so anyone holding it can change how much your business spends and where the money goes. A departing employee or a former agency that keeps admin can alter budgets, export customer-match lists, or remove other users, and the first sign is often a campaign nobody recognises.
Ownership matters as much as security. If the only admin on your account works for a supplier, moving away from that supplier becomes a negotiation instead of a decision. Insist that somebody inside your own business holds admin, whoever actually runs the campaigns day to day.
Common mistakes with access levels
The most common is handing out admin because it is the quickest way to stop somebody hitting a permission error. Once granted it is rarely reviewed, and the account ends up with a long list of people who could each change the billing.
Close behind is sharing one login between several people. It defeats two-factor authentication, and it destroys the audit trail — the change history then shows one name for every edit, so you can see what changed but never who changed it. The last is granting access to somebody’s personal Google account when a work account was available, which makes the permission impossible to revoke cleanly.
How to get it right
Keep at least two admins, both inside your own business, so nobody is locked out when one person is unavailable. Give the person running campaigns standard access. Give stakeholders who only want to see results read only, or email only if a scheduled report is genuinely all they need.
Review the user list on a schedule and whenever anyone leaves, on either side of the relationship. Prefer a manager account link for agencies over individual invitations, because it can be removed in one action. And when something in the account changes unexpectedly, read the change history before assuming the platform did it.