Roles and permissions
Launchpad answers two different questions for every request:
- What can this person do? That is their role and its permissions.
- Whose data can they see? That is tenancy: the client or clients they are tied to.
Both are enforced on the server. Hiding a menu item is a convenience, not the protection.
Roles
There are eight roles. People with the first three work across clients; the rest are tied to one client.
| Role | Sees data for | Typical use |
|---|---|---|
| Super Admin | Every client | Platform owner. Has every permission and cannot be reduced by overrides. |
| Admin | Every client | Platform administration: users, clients, settings, sync health. |
| Account Manager | Only the clients assigned to them | Day-to-day client management. Cannot open platform-only screens such as System, Sync Health, Issues, or the MCP Guide. |
| Client Admin | Their own client | Manages their own client's settings. Despite the name, this is not an admin role and never reaches the Admin section. |
| C-Level | Their own client | Reporting plus the C-Level view and Creative Lab. |
| Editor | Their own client | Reporting plus Creative Lab. |
| Viewer | Their own client | Reporting only. |
| Client User | Their own client | Same access as Viewer (kept for older accounts). |
A person tied to one client always sees that client, whatever address or setting they try. If their client is inactive they cannot load data.
Permissions
| Permission | What it opens |
|---|---|
view_dashboard | The Dashboard, Campaigns, Platforms, Insights, and Settings reporting pages |
view_ads_kpi | The Ads page |
view_creative_lab | Creative Lab, Best Ads, Reddit Research, Ad Inspiration |
manage_clients | Admin: Clients |
manage_users | Admin: Users |
manage_clickup | Admin: ClickUp Audit |
view_platform_admin | Admin: Sync Health, Issues, MCP Guide, System |
manage_spend_guards | Admin: Spend Guards. Granted to no role except Super Admin; see below |
manage_ads | Editing ad details: the ClickUp link, ad fields, transcripts, and ad metadata. Cross-client roles can do this without it |
manage_settings, view_c_level, view_admin_panel | Defined and granted as shown below, carried over from the earlier system; no screen currently depends on them |
Which permissions each role holds today:
| Role | Permissions |
|---|---|
| Super Admin | All of them |
| Admin | manage_users, manage_clients, manage_settings, manage_clickup, view_dashboard, view_ads_kpi, view_admin_panel, view_c_level, view_creative_lab, view_platform_admin |
| Account Manager | manage_users, manage_clients, manage_settings, view_dashboard, view_ads_kpi, view_creative_lab |
| Client Admin | manage_settings, view_dashboard, view_ads_kpi, view_creative_lab |
| C-Level | view_dashboard, view_ads_kpi, manage_ads, view_c_level, view_creative_lab |
| Editor | view_dashboard, view_ads_kpi, manage_ads, view_creative_lab |
| Viewer, Client User | view_dashboard, view_ads_kpi |
Some features are further restricted to Super Admins regardless of permission, because they change live ad accounts or shared settings: campaign on/off switches, daily budget edits, and shared export templates.
Custom roles and per-person overrides
On the Users page, a platform administrator can:
- Create custom roles on the Roles tab (a named set of permissions) and assign one to a person. A person has exactly one role: pick either a system role or a custom role.
- Add permission overrides on a person's page. An override grants one permission the role does not have, or removes one it does. Removing wins when both apply. Super Admin cannot be reduced.
Guard rails: only a Super Admin can promote someone to Super Admin, assign a custom role that includes Spend Guards, or add or remove the Spend Guards permission, because it can pause live campaigns. Password resets follow the same ceiling. Grant and revoke actions read the person's role from the database rather than from their sign-in, so they do not depend on a stale session.
Not signed in
A visitor who is not signed in sees only the public demo data, never a real client.