Managing client permissions
Maintain full control over what client stakeholders can see, review, or interact with inside their branded portal.
Permission scopes: hidden, view, and act
MyContentLab enforces a three-tier permission model for every section of the client workspace:
| Permission level | Description | Typical use case |
|---|---|---|
| Hidden | The section is completely removed from the client sidebar and navigation. | Modules managed internally by agency staff (e.g., Connections Hub, CRM setup, API tokens). |
| View Only | Client can inspect charts, review data, and download historical reports, but cannot edit or change statuses. | Executive KPI dashboards, multi-channel analytics, Brand Watch listening feeds. |
| Interactive / Act | Client can perform collaborative actions (approve scripts, leave feedback, submit video assets). | Content Lab calendar approvals, creative video uploads. |
Comprehensive permissions matrix
| Section / Feature | Hidden | View only | Interactive / Act |
|---|---|---|---|
| Executive Dashboard | — | View KPI tiles and AI summaries | N/A |
| Analytics (Paid & Organic) | — | View multi-channel charts | Filter date ranges and metric toggles |
| Content Lab & Calendar | — | View scheduled posts | Approve / request revisions on scripts |
| Creative Video Analysis | — | View retention scores | Upload new video assets for evaluation |
| Hook Library | — | Browse saved hooks | Bookmark favorite hook templates |
| Social Listening & Brand Watch | — | View sentiment and mentions | Draft or copy suggested replies |
| AI Visibility (GEO) | — | View AI citations and rank | N/A |
| Trends & Market Signals | — | View trending audio and topics | N/A |
| Sales & CRM | — | View pipeline and deal values | N/A |
| Executive Reports | — | Download PDF archives | Request ad-hoc report generation |
| Connections Hub | Always hidden | Hidden | Agency team only |
| Workspace Settings | Always hidden | Hidden | Agency team only |
Security best practices
IMPORTANT
Connections Hub Protection: The Connections Hub (where OAuth tokens and platform login credentials live) is always strictly hidden from client users. Clients can never disconnect ad accounts or view connected developer credentials.