Roles and permissions
Permissions Matrix
Every permission in Two Minute Reports and which of the six standard roles holds it, including which permissions require a seat.
This is every permission in Two Minute Reports — 80 of them, in 14 groups — and which of the six standard roles holds each one.
A tick means the role includes the permission. Where the Seat column says Yes, the member also needs an assigned seat: their role permits it, but nothing happens until a seat is assigned. See Seats for what that means in practice.
Reading this to work out why someone cannot do something? Check the Seat column first. A role that includes the permission plus a member with no seat is the most common answer, and adding a seat fixes it without changing anyone's role.
Connections
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View connections | See which platforms are connected and whether each is still authorised. Never exposes credentials or tokens. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Add and edit connections | Authorise a new platform, or re-authorise one that has expired. A connection is shared: once added, the whole team can build on it. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
| Remove connections | Disconnects the platform. Every dashboard, sheet and schedule drawing on it stops returning data. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
| View connected accounts | See the ad accounts, properties and profiles available under each connection. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Enable accounts | Makes an account available for reporting. Every connector has its own account limit on your plan, so enabling can hit that limit — and raising it costs money. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
| Disable accounts | Frees a slot against that connector's account limit. Reports already using the account stop returning data. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
| Send data setup links | Email a client a link that lets them connect their own accounts. They need no seat and never enter your team. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
Clients
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View clients | See the client list and which accounts belong to each. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Add and edit clients | Create a client, rename one, or change its branding. | Yes | ✓ | ✓ | ✓ | — | — | — |
| Remove clients | Deletes the client. Dashboards and goals attached to it are unlinked, not deleted. | Yes | ✓ | ✓ | ✓ | — | — | — |
| View account mapping | See which connected accounts are assigned to which client. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Map accounts to clients | Assign or reassign a connected account to a client. This decides what every client-scoped report contains. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
| Unmap accounts | Removes the assignment. Reports scoped to that client lose the account's data. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
| View client contacts | See the people saved on each client and pick them as recipients for briefings and setup links. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Add and edit client contacts | Save a person at a client, or change their name, email, job title or note. Briefings already sending to an old address keep using it. | Yes | ✓ | ✓ | ✓ | — | — | — |
| Delete client contacts | Removes the person from the client. Briefings that already send to their address keep sending to it. | Yes | ✓ | ✓ | ✓ | — | — | — |
Dashboards
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View dashboards | Open any dashboard in the team and see its data, including running the queries it already contains. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit dashboards | Build a dashboard, add or change widgets, change the layout. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Delete dashboards | Permanent, and for everyone in the team. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| View themes | See the team's themes. Choosing one for a dashboard or a report is part of editing it. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit themes | Create and change themes, and choose the team default. Every dashboard and report that uses a theme changes with it. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
| Delete themes | Reports using the theme switch to the team default. Dashboards using it keep its look as their own. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
| View who has access | See who can open each dashboard outside the team: its general access and the people added to it. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Share dashboards externally | Add people to a dashboard or change its general access. This shows data outside the team. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Remove people from a dashboard | They can no longer open it, unless its general access still lets them in. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| View briefings | See briefings, their recipients and their send history. A briefing is about a report, a dashboard, or nothing at all. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit briefings | Set up an email to a client about a report, a dashboard, or nothing at all: recipients, cadence and content. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Delete briefings | Stops a briefing's future sends and removes it from the list. What it already sent stays listed under Sent. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
Reports
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View reports | Open any report in the team, see its figures, and read the comments on it. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit reports | Create a report, edit its pages, blocks and design, refresh its figures, save it, and upload fonts for the team's reports. An edit reaches the client's share link, sends, and exports only when the report is saved again. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Delete reports | Deletes the report for everyone in the team. Its share link stops working for the client, and the record of what was sent is kept. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Comment on reports | Leave comments, reply, mention a team member, and resolve or reopen a thread. Comments are for the team only: they never change the report or appear in what the client sees. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| View who can open reports | See who can open each report's share link: its general access, the people added to it, and how often it was opened. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Share and export reports | Add people to a report's share link, change its general access, and export the report as a PDF, images or a PowerPoint file. This shows data outside the team. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Remove people from a report | They can no longer open the report's share link, unless its general access still lets them in. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
Goals
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View goals | See targets and pacing for any client or account. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit goals | Set a target, the period it covers and what it measures. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Delete goals | Removes the goal and its recorded history. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
Initiatives
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View initiatives | See the log of work done for clients and what each change moved. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit initiatives | Record a change made for a client, and close or archive one. Initiatives are never deleted. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
Custom Fields
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View custom fields | See the team's calculated metrics and dimensions and how each is defined. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit custom fields | Define a calculated metric or dimension. Editing one changes every dashboard, sheet and goal that uses it — which is why this sits above Editor. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
| Delete custom fields | Anything still referencing the field stops calculating. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
Google Sheets
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View sheet reports | See the team's Google Sheets reports and what each one pulls. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit sheet reports | Create a new sheet report or change an existing one. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Delete sheet reports | Removes the report from TMR along with its queries and schedules. The Google Sheet itself is not touched. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| View sheet queries | See the accounts, metrics, dimensions and date ranges behind each sheet. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit sheet queries | Change what a sheet pulls — accounts, metrics, dimensions, filters, date range. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Run queries | Refresh a sheet on demand, or run a query while building one. Each run calls the ad platform and costs us money, which is why it needs a seat even though viewing the same query does not. Scheduled refreshes are not affected — they run on the team's plan, with no person attached. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Delete sheet queries | Removes the query and any refresh schedule attached to it. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| View refresh schedules | See when each sheet refreshes and whether the last run succeeded. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit refresh schedules | Set how often a sheet refreshes automatically. Schedules count towards your plan's schedule limit, and the shortest frequency you may choose depends on the plan. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Delete refresh schedules | The sheet stops refreshing on its own. Manual refresh still works. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
Google Data Studio
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View Studio data sources | See the query configuration behind each Looker Studio data source. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit Studio data sources | Change what a Looker Studio data source pulls. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| Delete Studio data sources | Looker Studio reports built on it stop returning data. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
MCP & API Access
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| Connect AI clients over MCP | Lets this member's AI clients reach the team. What they can do once connected is exactly this member's permissions — never more. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Use the public API | Lets this member's API keys work against the team. A key carries the member's permissions and its scopes can only narrow them, never widen them. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Query data over MCP and the API | Build a query in the request — your choice of accounts, metrics, dimensions and date range — and get the rows back, without going through a saved report. Applies to those two channels only: in the Hub and in Google Sheets, building a dashboard or a sheet report is covered by that resource's own write permission. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
AI Features
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| Use Dash | Ask the AI assistant about the team's data. Dash can only reach what the member operating it can reach — it holds no permissions of its own. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Generate dashboards with AI | Have a dashboard built from a description. Free today; this may become a metered feature. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| View Watch Tower | See what Watch Tower has flagged across clients. Not yet released. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Configure Watch Tower | Act on what Watch Tower flags: re-run a check, mark a finding resolved, record feedback. Acting on a finding still needs the permission for that action: re-sending a failed briefing needs 'Create and edit briefings'. Configuring the rules is a separate permission. Not yet released. | Yes | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| View Watch Tower rules | See the rules that decide what Watch Tower flags, and which clients each one applies to. Not yet released. | — | ✓ | ✓ | ✓ | ✓ | — | — |
| Create and edit Watch Tower rules | Mute a signal, change its severity, or set a threshold — for one client or the whole team. A rule changes what everyone in the team is shown, which is why it sits above the permission to act on a finding. Not yet released. | Yes | ✓ | ✓ | ✓ | ✓ | — | — |
Team & Roles
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View team members | See who is in the team, the role each holds and who occupies a seat. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Invite members | Send an invitation. You can only offer a role whose permissions you hold yourself. | Yes | ✓ | ✓ | ✓ | — | — | — |
| Remove members | Only possible where the other member's permissions are contained in yours. The Owner can never be removed. | Yes | ✓ | ✓ | ✓ | — | — | — |
| Change member roles | Bounded in both directions: you cannot grant a permission you lack, and you cannot change someone who holds one you lack. | Yes | ✓ | ✓ | ✓ | — | — | — |
| Assign and remove seats | Decide who can change things, without changing anyone's role. A seat is a switch, not a capability — no role, standard or custom, can grant itself one. | Yes | ✓ | ✓ | ✓ | — | — | — |
| View roles | See the standard roles and any custom roles the team has built, and exactly what each one includes — including the role you hold yourself. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create and edit custom roles | Build a role from individual permissions. You can only include permissions you hold yourself — without that limit this is a superuser button. Restricted to Admin and Owner, and cannot be included in a custom role — see Custom Roles. | Yes | ✓ | ✓ | — | — | — | — |
| View team settings | See the team name and its defaults. | — | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Change team settings | Rename the team and set its defaults. | Yes | ✓ | ✓ | ✓ | — | — | — |
| View the audit log | See who did what and when — role changes, removals, external shares, plan changes. Not yet released. | — | ✓ | ✓ | ✓ | — | — | — |
Plan & Billing
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| View usage against plan limits | See how much of the plan is used — enabled accounts per connector, Google Sheets schedules, and seats. Not what any of it costs. Whoever can consume a limit can see it. | — | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| View the plan and invoices | See which plan the team is on, what it costs, the payment method on file, and past invoices. | — | ✓ | ✓ | ✓ | — | — | — |
| Change the plan and pay | Upgrade, downgrade, buy seats and add-ons, change payment details, and cancel the subscription. The one permission that can end the contract. | Yes | ✓ | ✓ | — | — | — | — |
Custom Domains
| Permission | What it does | Seat | Owner | Admin | Deputy | Data Mgr | Editor | Viewer |
|---|---|---|---|---|---|---|---|---|
| See the custom domain | See which domain client-facing report and setup links are served from, and whether it is currently working. | — | ✓ | ✓ | ✓ | — | — | — |
| Change the custom domain | Point a domain the agency owns at client-facing links, or remove one. Removing a live domain breaks every branded link already sent to a client — the reports themselves stay reachable at their original addresses, but the link in the client's inbox stops resolving. | Yes | ✓ | ✓ | — | — | — | — |
Totals
| Role | Permissions | What it is for |
|---|---|---|
| Owner | 80 of 80 | The person the subscription belongs to. Has the same permissions as an Admin, but cannot be removed or given another role by anyone, and can manage billing and assign seats even without a seat of their own. |
| Admin | 80 of 80 | Everything a Deputy Admin can do, plus the three nobody else has: managing billing — changing the plan, payment details, cancelling — creating custom roles, and setting the custom domain client links are served from. |
| Deputy Admin | 77 of 80 | Everything a Data Manager can do, plus runs the team: creates and deletes clients, invites people, sets roles, assigns seats, changes team settings, and reads the audit log and the plan. Can't change the plan, create roles, or set a custom domain. |
| Data Manager | 65 of 80 | Everything an Editor can do, plus owns the data everyone builds on: connections, connected accounts, which accounts belong to which client, custom fields and brand themes. Can't create or delete clients, and no team administration. |
| Editor | 52 of 80 | Everything a Viewer can do, plus builds the work: dashboards, briefings, goals, sheet queries and schedules. Can't add connections, map clients, or create custom fields. |
| Viewer | 25 of 80 | Can see everything the team has and change none of it. A good fit for clients and stakeholders. |
51 of the 80 permissions require a seat. The other 29 are reads, plus API and MCP access — a member with no seat can still see everything their role allows, and any integration they set up keeps running.
The six standard roles
Owner, Admin, Deputy Admin, Data Manager, Editor and Viewer: what each role is for, what it cannot do, and how to choose between them.
Seats
A seat is permission to act in one team: to change things, and to use what the team pays for. What a seatless member can still do on every surface, what is refused, and why scheduled refreshes never stop.