Google Ads MCC Governance for Agencies: Permissions, Ownership, and Change Control

1. Define what Google Ads manager account governance controls

Google Ads manager account governance is the system of rules an agency uses to control account relationships, user access, ownership settings, and responsibility for changes. MCC is the familiar industry term for a manager account. A sound governance model answers four questions for every client: who is the advertiser and account owner, which manager accounts are linked, which people can access the account, and who can authorize material changes?

Separate access, ownership, billing, and operating authority

These concepts overlap operationally, but they are not interchangeable. Access describes what a user or manager account can see or do. Manager-account ownership is a technical relationship that can provide additional control over a linked client account, including control of some user and manager-link actions. Billing identifies who pays or administers payment settings. Operating authority is the agency-client agreement about who may approve campaign changes. Manager-account ownership does not by itself establish legal ownership, data rights, or billing responsibility; document those matters separately.

• Account access: individual user permissions and access through linked manager accounts.
• Manager relationship: which manager accounts can reach the client account and whether one has the owner designation.
• Billing and advertiser responsibility: payment profile, invoicing arrangements, and the party responsible for charges.
• Change authority: who may propose, approve, and apply edits under the client’s contract and agency policy.
• Performance strategy: campaign structure, bidding strategy, budgets, and optimization goals.

Create a governance record for each account rather than relying on an org chart or a spreadsheet that lists only the account name. Record the customer’s legal or operating entity, customer contact, account ID, account time zone and currency, primary manager account, owner status, billing contact, named agency lead, client approver, and escalation contact. Include the approved conversion goals and budget authority so that an operator can distinguish a routine optimization from a decision that requires client approval.

2. Design account ownership and manager-account architecture

A manager-account hierarchy should make day-to-day access easy while preserving a clear path for the client to retain or regain control. Agencies commonly use a top-level agency manager account, optional regional or brand sub-manager accounts, and client accounts beneath them. Use sub-manager accounts only when they solve a real access or reporting problem. Extra layers make it harder to answer basic questions during an audit: which relationship grants this person access, which manager account can unlink the client, and who can approve a structural change?

Choose the owner arrangement before launch

Agree in writing whether the client or agency will hold the manager-account owner designation, where appropriate, and how that arrangement changes at contract end. The right choice depends on the client’s internal operating model, procurement terms, and need to work with multiple agencies. Avoid treating agency ownership as a default convenience. When an agency does hold owner status, identify a client sponsor, define the actions the agency may take, and document a transfer or removal procedure.

• Have the client create or retain the primary advertising account where the contract requires client control; link the agency manager account rather than silently creating a replacement account.
• Use a documented client approval for manager-account links, ownership changes, and unlinking. Record the approving person and date.
• Keep account IDs and link status in the agency system of record. Do not identify accounts only by campaign name, brand nickname, or login email.
• Do not assume billing access follows manager-account access. Verify the billing setup and responsible party separately.
• Before contract termination, agree on the order for transferring management, removing agency users, preserving required records, and confirming the client’s continued access.

For a multi-agency or in-house-plus-agency arrangement, write down which manager account is the operational route for each team. Avoid duplicate direct invitations when a manager relationship already supplies the necessary access, unless there is a specific support or continuity reason. Duplicate routes can make revocation incomplete: removing a manager link does not necessarily remove a user who also has direct account access.

3. Apply least-privilege Google Ads MCC permissions

Google Ads offers access levels such as Admin, Standard, Read-only, and Email-only. Their effective impact depends on whether access is assigned at a manager account or directly on an individual client account, as well as the account relationship and configuration. Do not assume that a role behaves identically across every route into an account. Test representative users, inspect the actual access view, and document which relationship grants each user access.

Use role definitions, not job-title assumptions

A senior title is not a reason to grant Admin access to every client account. Map each agency function to the actions it needs. A paid-search specialist may need Standard access to assigned accounts; a finance contact may need billing-related access where supported, without campaign-edit authority; an analyst may need Read-only access; and a client approver may need visibility to inspect proposed changes. Google Ads permissions are not a substitute for a formal agency approval policy, so maintain a separate record of who can authorize spend or strategy decisions.

• Give each employee or contractor an individual Google identity. Never share a team login or use a former employee’s account as a service identity.
• Assign Admin access only where the role requires user, manager-link, ownership, or other administrative actions.
• Grant access to the smallest relevant manager-account scope. Avoid giving every employee access to a top-level manager account if a sub-manager structure can safely limit exposure.
• Use Read-only access for audits and review wherever editing is not required.
• Require strong account security practices, including multi-step verification and prompt removal of access when employment or contract status changes.

Maintain an access register with the person’s name, work email, role, client scope, permission level, access route, business owner, approval date, and last review date. The access route field matters: it should distinguish direct client-account access from access available through a manager-account hierarchy. When a person cannot explain why they need a permission, downgrade or remove it after confirming the change will not disrupt a documented responsibility.

4. Govern the full access lifecycle and review cadence

Google Ads access governance is a lifecycle process, not a one-time setup task. The highest-risk failures usually come from stale access: a former employee retains a route through a manager account, a contractor is still present after a project ends, or an account has an unknown administrator. Build access checks into onboarding, role changes, client launches, contract changes, and offboarding.

Use an auditable request and removal process

• Request: the manager states the business reason, account scope, required access level, start date, and expected end date for temporary access.
• Approve: an authorized account owner or designated agency administrator verifies the request against the role matrix and client agreement.
• Grant: an administrator adds the named user or approves the manager-account relationship, then records the access route and date.
• Verify: the requester confirms the expected account appears and that the permission level supports the assigned work, without excess access.
• Review: the account owner or agency administrator checks users, manager links, and owner status on the agency’s recurring schedule.
• Revoke: on role change or departure, remove all direct and inherited access routes, verify that access is gone, and record completion.

A useful baseline is a monthly review of Admin users and manager-account owner relationships, plus a quarterly review of all users and links. High-risk accounts, regulated clients, accounts with unusually high spend, and short-term contractors may need monthly full reviews. Trigger an immediate review after a security incident, employee departure, agency transition, ownership change, or discovery of an unknown user. Assign one accountable reviewer and keep evidence of completion.

5. Establish Google Ads change control for agencies

Google Ads change control for agencies defines how an edit moves from an idea to an authorized account mutation. It should protect the client from unintended spend or tracking changes while allowing low-risk maintenance to continue. The policy should classify changes by impact, name who can approve each class, require a record of before-and-after values, and specify how to verify or roll back the result.

Classify changes by operational risk

For every material or critical change, record the account and campaign scope, current setting, proposed setting, reason, expected outcome, key risk, approver, operator, planned time, and verification criteria. Include a reversibility check: can the previous setting be restored quickly, and would reversal itself create risk? For conversion tracking, preserve the action name, primary or secondary status, value logic, attribution setting where relevant, and any downstream reporting dependency before changing configuration.

• Separate proposal from approval. The person who identified a change should not silently treat the proposal as client authorization.
• Set approval thresholds in the client agreement or account plan, such as permitted budget movement, target changes, and campaign launch authority.
• Use a pre-change check for conversion tracking, landing pages, location and language targeting, campaign status, budget, and affected account scope.
• After implementation, verify the live setting and inspect performance or tracking signals at a time appropriate to the conversion lag.
• Use Google Ads change history as one audit source, but retain the business rationale and approval record in the agency’s change-control process.

PPC Tuner supports this human-in-the-loop model as a Gemini 3.8 AI alternative to unreviewed automation: it stages proposed account mutations for review and approval inside its secure web application workspace. An agency operator can inspect the account scope, intended change, and business rationale before approving an operation. Keep the agency’s client approval rules in force; a staged proposal is not itself client authorization, and the approval record should remain part of the account’s governance trail.

6. Scale governance to spend, conversion lag, and change impact

A small account still needs safe access controls, but a $200,000 monthly portfolio cannot rely on the same informal review model as a single $5,000 account. Scale the number of independent checks, approval coverage, and monitoring cadence with financial exposure and operational complexity. The matrix below is a starting point for agency operating design, not a Google requirement or a universal client policy.

Use performance thresholds without mistaking them for access policy

Access rules should determine who can act; performance guardrails should determine when a proposed optimization needs review. Write the client’s target CPA or target ROAS into the account plan, along with the source conversion actions, acceptable budget range, and conditions for escalation. Avoid using a single portfolio-wide target when accounts have different margins, lead quality, or conversion definitions.

• Define a CPA escalation band against the approved target, for example, investigate when a mature reporting window is materially above target rather than changing bids after one poor day.
• For ROAS, define an approved target and a tolerance band that accounts for value reporting delays, refunds, and margin differences. A short-term ROAS dip is not sufficient evidence if the value window is incomplete.
• Set a minimum evidence rule for performance-based decisions. As a practical operating default, consider waiting for a full conversion-lag window and sufficient conversions in the relevant campaign or goal cohort; a 20-to-30-conversion observation is a possible starting point, not a platform requirement.
• Specify when an operator may change a daily budget without approval, such as a client-approved percentage or dollar cap. Changes outside the cap require the named approver.
• Keep budget pacing and bid strategy reviews separate. A campaign can be on pace while missing its CPA goal, or meet its CPA goal while underspending because of limited eligible demand.

A basic pacing check compares actual spend to planned spend through the same point in the month. Calculate planned-to-date spend as the approved monthly budget multiplied by elapsed calendar days divided by total calendar days in the month. Calculate pacing variance as actual spend minus planned-to-date spend, divided by planned-to-date spend. Set account-specific escalation bands rather than applying the same tolerance to every client: a small absolute overspend can be material on a low-budget account, while a percentage-only alert can overreact on a large account.

Consider conversion lag before taking corrective action. If a meaningful share of conversions arrives several days after a click, evaluate performance using a mature window that accounts for that delay and compare periods with equivalent weekdays. For a sudden tracking anomaly, investigate immediately; for a short-term CPA or ROAS fluctuation, avoid a structural bid or budget change until the agreed evidence threshold is met. This distinction prevents governance rules from turning into reactive optimization.

Apply the same control logic to Performance Max assets

Asset-group changes can affect message coverage, landing-page relevance, and the distribution of campaign traffic. Require a distinct asset group when it supports a genuinely different product, service, audience proposition, or landing-page experience—not merely to create another reporting row. For a material change, record the asset group’s purpose, final URL, audience signals if used, required creative coverage, and how success will be evaluated. Review asset strength and policy status, but do not treat an asset label as proof of business performance.

When an agency is investigating wasted spend, demand limits, or overlapping campaign coverage, use a diagnostic before authorizing a structural change. The Google Ads Waste Calculator can help frame waste analysis, the Lost IS Calculator can clarify impression-share constraints, and the PMax Cannibalization Checker can support a review of potential overlap. These tools inform a human decision; they do not replace account-level access controls or client approval.

7. Audit the system and roll it out across the client roster

A governance policy only works if it is usable across the full roster. Start with a small pilot, test account access paths, and resolve exceptions before making the process mandatory. Then use the same core fields and review cadence across accounts, with additional controls for sensitive clients. Make it easy for account teams to identify the approver and the allowed change range without searching through old email threads.

Run a quarterly governance audit

• Reconcile the agency account inventory against active client contracts and confirm the account ID, account time zone, currency, and assigned account lead.
• Review every linked manager account and record which one has owner status, if any. Confirm the relationship with the client’s documented agreement.
• Export or inspect the current user list and compare it with the access register. Investigate unknown users, duplicate access routes, excessive Admin roles, and expired temporary access.
• Sample high-impact changes from the review period. Confirm proposal, approval, implementation evidence, and post-change verification are present.
• Test an offboarding or agency-transition scenario for at least one account. Confirm the client retains the agreed access and the agency can remove all routes cleanly.
• Track exceptions with an accountable owner and due date. Close each exception only after the relevant access or change-control evidence is verified.

Useful governance measures include the percentage of accounts with a current owner and approver record, the percentage of Admin users reviewed on schedule, the number of unknown access routes, time to revoke access after offboarding, the share of material changes with documented approval, and unresolved audit exceptions. These measures are more actionable than a general statement that accounts are secure because the agency uses a manager account.