How-to

Meta ad account roles for agencies: who can build ads, who can publish them, and who can spend

Every agency wants a junior to build the client batch and a senior to decide what goes live. Meta's permission model does not have that role; its one publish gate is a security setting the client controls. Here is what Meta does have, per its own documentation, and four ways to get the split anyway.

Adlio teamPublished 23 September 2026Updated 24 October 20269 min read

The short answer

Meta gives an ad account three roles, Admin, Advertiser and Analyst, and none of them lets a person build ads without also being able to publish them. Whoever can create and edit ads can switch them on, on the client's funding source. The one native publish gate is not a role but a security setting: with peer approval on "Extra protection", every ad waits for a trusted user of the business portfolio that owns the ad account, and only that portfolio (for client work, the client) can switch it on. So if you want a junior or a freelancer to build a client's batch while someone senior decides what goes live, Meta offers two narrow native routes (Creative Hub mockups and the client's peer approval), and otherwise the split has to come from your process or your launch tool.

Everything Meta-specific below is quoted from Meta's help centre and Marketing API reference, checked on 23 September 2026; the peer approval part was added and checked on 28 September 2026. What we recommend on top of that is labelled as our default.

The roles Meta actually has

In Ads Manager, "ad accounts have 3 permission roles". In a business portfolio (Business Manager) the same access is handed out as tasks: three kinds of partial access and one kind of full access. Side by side, from Meta's two help pages:

Ads Manager role	Business portfolio access	View ads	Create and edit ads	Reports	Payment, settings and permissions
Admin	Manage ad accounts (full)	yes	yes	yes	yes
Advertiser	Manage campaigns (partial)	yes	yes	yes	no
Analyst	View performance (partial)	yes	no	yes	no
none	Manage Creative Hub mockups (partial)	no	no	no	no (mockups only)

The quotes that matter:

Advertiser: "can create, edit, and manage ads, as well as view all ads and access performance reports. Advertisers cannot change the payment method on the ad account and cannot add or remove other people's access."
Analyst: "has view-only access. Analysts can view existing ads and access performance reports, but cannot create ads, edit ads, change payment methods, or manage other people's permissions."
In the Marketing API, the same Advertiser access is described as: "Create ads using the funding source associated with the ad account."

Notice what is missing. "Create and edit ads" is one permission, and there is no row called "publish". In the documentation we read, there is no role that may build an ad but not switch it on. That absence is the whole problem for an agency: the person who can build the batch can also make it spend. The nearest thing to a publish step is peer approval, below, and that is a second review, not a role.

Why paused is the line that actually protects the budget

Ads can be created in two statuses, active or paused. Meta's Marketing API reference: "When an ad is created, it will first go through ad review, and will have the ad status PENDING_REVIEW before it finishes review and reverts back to your selected status of ACTIVE or PAUSED. During testing, it is recommended to set ads to a PAUSED status so as to not incur accidental spend." And: "New ads are in pending state and do not run until Facebook approves or rejects them. After we approve an ad it runs."

Two consequences for an agency:

A batch created active goes live on its own the moment review clears, with no human in between. A batch created paused is reviewed straight away and then waits. More on that timing in Facebook ad review in bulk.
Meta charges on delivery ("usually, you're charged based on the number of impressions your ad receives"), so a paused ad that never delivers costs nothing. That is our reading of Meta's billing pages; Meta does not say it in one sentence.

Paused protects the budget only until someone with Advertiser access switches the ads on. Which brings us back to who holds that access.

Four ways agencies split building from publishing

1. Creative Hub mockups (Meta-native)

The one place where Meta's permissions separate the two. Per its Creative Hub permissions page, "Create, view and edit mockups" and "Share mockups via link" are open to Admin, Advertiser and "Manage Creative Hub mockups", while "Create ads from mockups" is limited to "Admin, Advertiser". So a junior with only mockup access builds and shares, and a senior turns approved mockups into ads.

The limits are real. Meta lists unsupported objectives ("Engagement (with the conversion location Facebook Page) and App promotion (Meta Advantage+ app campaigns)") and "dynamic creative ads are also not supported". And a mockup still has to become an ad one by one in Ads Manager, which is fine for three concepts and slow for a forty-creative batch (our view).

2. Peer approval on the client's ad account (Meta-native, a gate rather than a role)

Meta does have one publish gate; it sits under security, not under roles. With peer approval, "ads must be reviewed by a trusted user of the ad account before they can be published". On the "Extra protection" level every ad "needs approval before it can run", and Meta recommends that level "for ad accounts that have partners who advertise on behalf of the business or people with temporary access": an agency, seen from the client's side. The trusted user reviews "budget, creative, URLs, and region", selects "I approve this ad", then Publish. It is set up in Meta Business Suite under Settings, Security Center, Peer approval.

For an agency, the ownership rules decide who holds the gate:

"To set up or edit peer approval, you must have full control of the business portfolio", and "The business portfolio must own the ad account you want to add peer approval to." A client account shared with you stays in the client's portfolio, so the client switches it on, not you. On ad accounts your own portfolio owns you can use it internally: with Extra protection, juniors build and their ads wait for a trusted user.
Trusted users come from the owning portfolio: "People with full control of the business portfolio are trusted users by default", and people with basic access to the portfolio who also have access to the ad account can be added.
"Ads published by people with full control of the business portfolio do not require a second review." Whoever has full control is never held.
Meta does not state whether ads created through the Marketing API, which is how launch tools create them, are held the same way, or whether ad account peer approval is available to every portfolio.

The gate does not narrow anyone's Advertiser access. It puts a second person between building and running, and that person sits on the side of the portfolio that owns the account.

3. Drafts and one named publisher (a convention)

Everyone who builds gets "Manage campaigns", everyone works in drafts ("before you publish your ad it's considered a draft"), and one senior uses "Review and publish". Jon Loomer describes the client-approval version of this: share the draft preview link, with the catch that "you'll need to keep your ad in draft while your client reviews it" (secondary source).

Be honest about what this is: a rule people follow, not a control. Every person with "Manage campaigns" can still publish. It works in a disciplined team of three and erodes the week someone is in a hurry.

4. A launch tool that only creates paused ads, with its own permissions

We are Adlio, so weigh this section accordingly. This is the split we built for: on the Team plan, a team member logs in with their own email and works through the agency owner's Facebook connection, so they need no role in the client's business portfolio at all. They see only the client ad accounts you share with them, and per account you decide whether they may launch. Every ad Adlio creates is paused, with no setting that changes that, so the most a member can do is put a paused batch in the client's account. Switching it on happens in Ads Manager, by someone who has access there. Adlio creates ads through Meta's Marketing API, and Meta does not say whether peer approval holds ads created that way, so we do not claim it does.

Without launch rights a member can see the account and edit its copy, naming and UTM defaults, but cannot upload or create ads. The Page, Instagram account and EU DSA details stay with the owner either way. How the per-account settings keep clients apart is in managing multiple Facebook ad accounts; the agency view is on the agency page. An in-house team with one ad account per app or brand gets the same split: a new colleague launches in the accounts you share, without the founder's Facebook login, and nothing goes live until someone switches it on. See the page for in-house teams.

The client's side: partner access and a spending limit

The client stays in charge of what the agency may do. From Meta's partner pages:

The client shares the ad account with the agency's business portfolio as a partner and chooses "full control of the business asset, or partial access".
Even with full control, a partner "cannot share the business asset with another business"; only the owner can.
With partial access, the agency "can only assign people in their business portfolio permission to complete the specific tasks that you have assigned the partner". The client's choice caps what the agency can hand down to its own people.
The client can remove the partner at any time, provided they have full control of their own portfolio.

A second safety net that only the client's admin can set is the account spending limit: "When you reach this limit, your ads pause, and your ad account stops spending money." And: "You have to be an admin of an ad account to create an account spending limit."

For freelancers there is temporary access: it "provides only basic access for a minimum of 3 days and a maximum of 75 days", after which the person is removed automatically.

A setup that holds up (our default)

Client to agency: partner access with "Manage campaigns" on the ad account. Full control only if you really manage the client's billing or permissions.
Inside the agency: "Manage campaigns" on a client account only for the people who decide what goes live there. Everyone else gets "View performance", or no Meta role at all if they build through a tool.
Every batch lands paused. Run the pre-launch QA checklist on it, then one named person switches it on.
Where the client wants a hard stop: peer approval with Extra protection on their ad account, their setting and their approvers. Agree who approves and how fast, and test first how it treats ads from your launch tool, because Meta does not say.
A spending limit on every client account, set by the client's admin, sized to a bad week rather than a normal one.
Freelancers on temporary access with an end date, so access does not outlive the job.
In the EU: check that the DSA beneficiary and payer are right for this client before anything goes live; see DSA beneficiary and payer fields.

If you want steps 2 and 3 enforced rather than agreed, that is what a paused-only launcher with per-account launch rights gives you; see how bulk upload works. The first 15 ads are free, without a card.

Frequently asked questions

Can I give someone access to create Meta ads but not publish them?+

Not with an ad account role. Meta's partial-access permission "Manage campaigns" covers viewing, creating and editing ads, and there is no separate publish permission; the Advertiser role "can create, edit, and manage ads". The closest native split is Creative Hub: someone with only "Manage Creative Hub mockups" can build and share mockups, and only an Admin or Advertiser can turn them into ads. There is also one native publish gate, which is not a role: peer approval. With "Extra protection" on, "every ad needs approval before it can run" by a trusted user, but only someone with full control of the business portfolio that owns the ad account can set it up, and "ads published by people with full control of the business portfolio do not require a second review". Otherwise the split has to come from your process or your launch tool.

What is the difference between Advertiser and Analyst on a Meta ad account?+

Per Meta, the Advertiser role "can create, edit, and manage ads, as well as view all ads and access performance reports" but "cannot change the payment method on the ad account and cannot add or remove other people's access". The Analyst role "has view-only access": existing ads and reports, no creating or editing. Only an Admin manages payment and permissions.

Do paused ads cost money or go through review?+

They are reviewed at creation: Meta's Marketing API documentation says a new ad first has the status PENDING_REVIEW and then "reverts back to your selected status of ACTIVE or PAUSED", and recommends PAUSED during testing "so as to not incur accidental spend". Meta charges on delivery (usually impressions), so an ad that stays paused and never delivers is not charged. That last step is our reading of Meta's billing pages, not one Meta sentence.

Should an agency ask for full control of a client's ad account?+

Usually not. Creating and running ads needs "Manage campaigns" (partial access); only full control ("Manage ad accounts") adds the ad account's settings, finances and permissions. Leaving payment and access with the client is cleaner for both sides, and the client keeps the power to remove the partnership. This is our default, not a Meta rule.

Sources

Adlio team

Built by media buyers who launch Meta ads in volume. Questions or corrections: support@adlio.ai.

Topic cluster

Teams and client accounts

Running Meta ads across many ad accounts with more than one person: access, roles, approval, and keeping accounts apart.

Start here

Managing multiple Facebook ad accounts without leaks

How an agency gets access to a client's Meta ad account: partner access, step by step
How to give a colleague access to your Meta ad accounts (without sharing your Facebook login)
Meta ad account roles for agencies: who can build ads, who can publish them, and who can spend
Who changed this Meta ad? Ads Manager activity history, and what it misses for agency teams
Client approval for Meta ads: five ways agencies get sign-off before anything goes live
Meta ads in the EU: the DSA beneficiary and payer fields, and how to set them once