Roles and permissions
Everyone you add to a team gets a role and, optionally, a seat. Those are two different decisions, and keeping them apart is what lets you invite a whole agency without paying for a whole agency.
- A role is what a person is allowed to do: view dashboards, build them, set up connections, run the team, change the plan.
- A seat is whether they can change anything at all. A member without a seat can see everything their role allows and change none of it.
The current plans include unlimited seats, so you can add your whole team and decide what each of them can do. On a plan bought before July 2026 the seat count is fixed, and it also caps how many people can be in the team.
The one-paragraph version
Invite everyone who needs to see the work. Give a seat to everyone who needs to do the work. If someone reports that a button is unavailable, it is almost always because their role allows the action but nobody has assigned them a seat. Assigning a seat fixes it. Changing their role does not.
Why two separate ideas
Most teams have more people who need to look at dashboards than people who build them. An account manager reviewing a dashboard before a call, or a founder glancing at spend: neither of them touches a query.
Those people should be able to see the work without being able to change it. A role on its own does not quite express that: "Editor, but read-only for now" is a real thing to want when somebody joins, goes on leave, or is a client you would rather not have editing your dashboards. The seat is that switch, and it moves without touching anyone's role.
What happens without a seat
A seatless member can do everything their role allows except change things. Concretely:
| They can | They cannot |
|---|---|
| Open the Hub and read every dashboard and client their role allows | Create or edit a dashboard, client, goal or theme |
| Open the Google Sheets add-on and read the queries and schedules in a sheet | Create, edit or delete a query or schedule, or refresh a sheet on demand |
| Open the Google Data Studio popup and see the connections and query configs | Add a connection, enable an account, or create a query config |
| Keep an API key or MCP connection they already set up working | Use that key for anything a seat would be needed for in the interface |
| See how much of the plan is used, if their role includes it | Change the plan, buy seats, or cancel |
Scheduled refreshes are not affected by anybody's seat. They run on the team's plan with no person attached, so a sheet does not stop updating because the person who built it lost their seat.
Both live in the Hub under Settings › Members, one column each, so a member's role and their seat are always visible together.
A role applies to all clients
A role applies to the full team. Each member can see all the clients, connections and dashboards of the team. You cannot give a member access to only some clients.
A custom role cannot change this. The View permissions are in every role, and you cannot remove them. Refer to Viewing is always included.