Two things decide what someone can do:
Their role — owner, admin or member. What kind of actions they can take.
Their site access — every site, or the ones you pick. Which data those actions apply to.
They are independent. An admin scoped to one site has admin powers on that site and cannot see the others at all.
The complete table
| Owner | Admin | Member | |
| Analytics (for sites they can see) | |||
| View the dashboard | ✅ | ✅ | ✅ |
| Use drill-down filters and date ranges | ✅ | ✅ | ✅ |
| View the AI panel | ✅ | ✅ | ✅ |
| Sites | |||
| Add a site | ✅ | ✅ | ✅ |
| Edit settings, exclusions, identity mode | ✅ | ✅ | ✅ |
| Delete a site | ✅ | ✅ | ❌ |
| Sharing | |||
| Create or revoke a share link | ✅ | ✅ | ✅ |
| API keys | |||
| Create or revoke an API key | ✅ | ✅ | ❌ |
| Team | |||
| See who is on the team | ✅ | ✅ | ✅ |
| Invite, change a role, remove someone | ✅ | ❌ | ❌ |
| Change who can see which sites | ✅ | ❌ | ❌ |
| Billing | |||
| See the plan and usage | ✅ | ❌ | ❌ |
| Change plan, card, invoices | ✅ | ❌ | ❌ |
| The organisation | |||
| Delete the organisation | ✅ | ❌ | ❌ |
Site access
By default a new member sees every site, including any you add later.
To narrow that, open Settings → Team, find the person and click Change next to their site access. Pick Only the sites I pick and tick the ones they should see.
What a scoped member loses is the site entirely — not just its row in the list. They cannot open its dashboard, read its goals, see its Search Console data or its revenue, and cannot reach it through the API. There is no partial view.
The owner always sees every site and cannot be scoped. An owner confined to a subset could not assign, or even see, the sites outside it — which would leave an account nobody can administer.
This is what makes an agency workable: twelve clients in one organisation, and each client's marketer sees only their own site.
The distinctions worth knowing
Only the owner manages the team and billing. Inviting, changing roles, removing people and setting site access all sit with the owner, alongside the card and the plan. Admin is deliberately not a second owner.
Admin can delete a site, member cannot. That is the difference between the two. Deleting a site removes its history and cannot be undone, so it needs the higher role. Admin also covers API keys.
Member is the working role. Add sites, change settings, manage exclusions, create share links. Enough to run analytics day to day.
If they only need to look, use a share link instead. A share link costs no seat, needs no account, and can be pointed at a single site. For a client who only reads numbers, that is usually the better answer.
Which role to give
| They need to | Role |
| Only look at numbers | No seat — share link |
| Run analytics day to day, add sites, manage exclusions | Member |
| All of that, plus delete sites and manage API keys | Admin |
| All of that, plus the team and billing | Owner |
Give the lowest role that works, and narrow their site access if they only work on some of your sites.
The owner
Every organisation has exactly one owner — whoever created it.
The owner cannot be removed, cannot have their role changed, and cannot be scoped to a subset of sites. All three would leave the account without anyone able to run it.