The Stellenbosch Scenario: A Retainer Ends, and Three Logins Outlive It
A hypothetical B2B software firm in Stellenbosch ends a six-month retainer with a freelance Google Ads buyer. Three months later, the marketing manager finds the contractor still holds Standard access to Google Ads, a stale OAuth token is pushing conversion data into a third-party dashboard, and the freelancer is a delegated owner on Search Console. None were granted maliciously - they were simply never revoked. This is the delegate-to-revoke gap South African marketing teams must close systematically.
Delegated access management is not about trusting partners less. It is about building a lifecycle - grant, review, revoke - that survives staff turnover, agency changes and the common SA pattern of an in-house team working alongside one agency and one freelancer on the same account.
What 'Delegated Access' Actually Means Across Four Google Surfaces
Google uses the word 'access' across four distinct systems, each with its own permission model, revocation path and failure mode.
| Surface | What You Delegate | Where It Is Set | Common Roles |
|---|---|---|---|
| Google Ads | Campaigns, billing and users | Tools & settings → Access and security | Admin, Standard, Read-only, Emails-only |
| Search Console | Property data and settings | Settings → Users and permissions | Owner, Full, Restricted |
| Google Workspace | Admin roles, email delegation, API scopes | Admin console → Directory / Security | Super admin, delegated admin, Gmail delegate |
| Google Business Profile | Listing management | Business Profile Manager | Primary owner, Manager |
Grant Access Without Handing Over the Keys: The Client-Owned Account Model
The most effective control is structural: the client retains ownership of the Google Ads account, and the agency operates from its own manager account (MCC) with access granted. Never reverse this. When the client owns the account, revocation is one action - removing the MCC link - and data, billing profile and change history stay under client control. This is how Prebo Digital's Google Ads practice operates: the client holds the account, the agency holds delegated access, and the relationship can end cleanly without a migration project.
Rule of thumb: if the agency created the account, request ownership transfer before the first invoice. A client-owned account also keeps billing on the client's payment profile, simplifying POPIA accountability and VAT documentation.
The Minimum Viable Access Matrix: Matching Role to Permission Level
Over-granting is the default failure mode. A reporting analyst does not need Standard access; a media buyer should not hold billing rights. Use this matrix as a starting point and document every exception.
| Role | Google Ads Level | Search Console | Notes |
|---|---|---|---|
| Reporting analyst | Read-only | Restricted | No billing, no user management |
| Media buyer | Standard (billing off) | Full | Can edit campaigns, cannot change payment |
| Strategy lead | Standard | Full | Same as buyer; no admin rights |
| Billing / owner | Admin | Owner | Named client staff only, never agency |
Watch the Emails-only level. It looks harmless, but still exposes the account email address and can receive account notifications - a subtle exposure point when a contractor leaves. Remove it alongside Standard access.
Why .co.za Workspace Domains and Consumer Gmail Logins Behave Differently
Many South African marketing teams run the Ads account on a consumer Gmail address rather than a verified .co.za Workspace domain. A consumer login has no admin console, so there is no central place to revoke OAuth grants or audit app access. With Workspace, an admin can control app access by organisational unit and see login events. On a personal Gmail, the only revocation path is the owner visiting myaccount.google.com/connections - and if that owner has left, it becomes a recovery problem. Where possible, migrate the Ads account to a Workspace group email (e.g. ads@yourcompany.co.za) so access follows the role, not the person.
The Grant Checklist: What to Confirm Before Day One of a Retainer
- Second admin exists on the client side, with 2-Step Verification confirmed.
- Access is granted to a Workspace group email, not an individual's personal Gmail.
- Billing profile remains under client ownership and is not shared with the agency.
- MCC link is recorded in the access register with date and requesting party.
- Search Console ownership stays with the client; agency receives Full or Restricted.
- Third-party tools connect via a shared service account, not a personal OAuth token.
The Quarterly Access Review: A Register, a Cadence and a Named Owner
A one-page access register makes everything else auditable. It lists every surface, every person or entity with access, their role, the date granted, the next review date, and who is responsible for revoking. Assign a named access owner - typically the marketing ops lead or an agency account director - and put a quarterly review in the calendar. Reconcile the register against Google Ads change history so changes by unfamiliar users surface immediately. For a reporting framework around this, Prebo Digital's reporting approach outlines how access data feeds into client-facing reports.
| Register Field | Example Entry | Why It Matters |
|---|---|---|
| Surface | Google Ads | Different revocation paths |
| Person / entity | Agency MCC 123-456-7890 | Links to change history |
| Role | Standard | Defines capability |
| Granted on | 2025-03-01 | Age of access |
| Next review | 2025-06-01 | Cadence enforcement |
| Revoker | Client marketing manager | Accountability |
The Revocation Sequence: What to Remove, in What Order
Order matters. Removing a user role before removing the MCC link leaves the manager account still linked, and some tools will silently re-authorise. Follow this sequence:
1. Remove MCC link / manager account access
2. Revoke OAuth tokens at myaccount.google.com/connections
3. Remove delegated Search Console owners
4. Remove Google Ads user roles (Admin → Standard → Read-only → Emails-only)
5. Remove Google Business Profile managers
6. Remove Workspace app / domain-wide delegation grants (IT team)
7. Rotate shared passwords and container IDs (GTM, GA4)What Silently Survives Revocation - and How to Chase It Down
Several access types do not disappear when you remove a user from Google Ads. Third-party tools acting on the user's own OAuth grant continue working until that grant is revoked at the Google Account level. MCC links survive user removal. Search Console verification can remain attached to a former employee's account. Looker Studio connectors often run under a personal login, and GA4 or GTM access may have been granted separately from Ads. The audit must chase these down surface by surface.
The delegated Search Console owner trap: an agency invited as Owner can invite others, and those invitations can outlive the relationship. Always check the full user list, not just the account you remember granting.
POPIA in Practice: Client and Agency Roles When Access Is Delegated
Delegated access means account activity may involve processing of personal data - customer lists, remarketing audiences, call recordings. Under the Protection of Personal Information Act, the client is typically the responsible party and the agency the operator. The practical control is a written operator agreement with defined purpose, duration and security measures. This is governance, not legal advice; teams granting access to UK or EU agencies also touch GDPR. The Information Regulator publishes guidance on operator obligations.
Domain-Wide Delegation and API Tokens: The High-Risk Corner of the Estate
Domain-wide delegation lets a service account impersonate any user in the Workspace domain. It is powerful and rarely reviewed. If IT set it up for a reporting tool, audit the authorised scopes annually and remove any no longer needed. API tokens and service account keys should be rotated when a contractor leaves, even if the Google Ads user role has been removed.
What 'Managed' Looks Like: Reconciling the Access Register with Change History
A managed estate is one where the access register and Google Ads change history agree. Schedule a monthly reconciliation: pull the change history for the period, map each change to a named user in the register, and investigate any change from an unknown or unexpected user. This is not surveillance - it is the same discipline as reconciling a bank statement. For teams that want to institutionalise this, strategy consulting can help design the cadence and register format that fits your team size and risk appetite.
The outcome is not a one-time cleanup. It is a repeatable lifecycle: grant with least privilege, review quarterly, revoke in sequence, and reconcile monthly. That is what keeps a Stellenbosch retainer ending from becoming a three-login mystery.
Sources
- Google Ads Help - Access levels in Google Ads
- Google Ads Help - Grant access to your Google Ads account
- Google Search Console Help - Managing owners, users, and permissions
- Google Workspace Admin Help - Delegated administration and role privileges
- Google Workspace Admin Help - Control API access with domain-wide delegation
- Information Regulator (South Africa) - POPIA
