Here’s a scenario you’ve probably lived through. A junior team member is supposed to be drafting posts. Somehow they also have the power to approve and publish them. One Friday afternoon, a half-finished caption goes live because nobody set up permissions properly, and now someone’s writing an apology email instead of going home.
Roles and permissions sound boring until the day they save you from exactly that. So let’s make them simple.
The basic roles every team needs
Strip it down and most social media teams need five kinds of access, whether you’re one person wearing five hats or a fifteen-person agency.
- The creator. Writes captions, picks images, builds the post. Shouldn’t be able to publish without someone else looking at it first, even if that someone is themselves on a different day.
- The internal reviewer. Checks brand voice, spelling, whether the image actually shows the product. Catches the stuff before a client ever sees it.
- The client (or final approver). Says yes or no. Doesn’t need to edit anything, doesn’t need to see your internal Slack argument about the font, just needs a clean look at the finished post and a button to press.
- The admin. Manages the team itself. Who’s on it, what they can touch, billing, that kind of thing. Usually one or two people, not the whole team.
- The specialist. Designers, translators, whoever touches one part of the content without needing the whole picture. A translator doesn’t need to see analytics. A designer doesn’t need billing access.
Not every team needs all five as separate people. A two-person shop might have one person doing creator and reviewer, and the client doing the approving. That’s fine. The point isn’t headcount, it’s making sure each of those jobs actually happens and nobody accidentally has more power than their job calls for.
Who should be able to publish
Short answer: as few people as possible. Publishing access is the one permission that turns a mistake into a public mistake. Everyone else’s errors get caught somewhere in the chain. The person who can publish is the last stop. Most agencies limit this to account managers or team leads, and even then, only after the post has an approval attached to it.
A decent rule: if someone can publish without an approval step in front of them, that’s not a role problem, that’s a process gap. Fix the workflow before you fix the permissions.
Client-side roles: keep it simple
Clients don’t want a login they have to remember, and they definitely don’t want to see your internal comments about whether the client’s own CEO looks good in that photo.
Give clients exactly one thing: a clean approval view. They see the finished post, they leave feedback or hit approve, and that’s the whole interaction. In Kontentino, the client role is built around this: they only see posts once they’ve cleared internal review, and their comments stay separate from your team’s internal back-and-forth. No seat cost either, so you’re not paying more because a client added a second person to the review chain.
If a client wants edit access (some do, especially in-house marketing teams working alongside an agency), that’s a different conversation and a different role. Don’t default to giving it just because they asked. Ask what they actually need to do, and match the access to that.
How agencies actually split up teams
Two common patterns, and both work fine depending on your size.
👉 The pod model. Small teams (2 to 4 people) each own a set of clients start to finish. One person might be creator and reviewer for their pod’s accounts. Works well under about 10 clients, because everyone in the pod knows the accounts inside and out.
👉 The functional model. Bigger agencies split by job instead of by client: a content team writes for everyone, a review team checks everything, account managers handle client relationships and final sign-off. This scales better past 15 to 20 clients, because you’re not retraining a whole pod every time you win new business, you’re just plugging people into functions they already know.
Neither is “correct.” Pod model feels more personal and clients often prefer it. Functional model is more efficient at scale. Pick based on your size, not on what sounds more impressive in a pitch deck.
A simple permission template by team size
Solo or two-person shop: One person does creation and internal review. Client approves. That’s the whole chain. Don’t overbuild this.
Small agency (3 to 8 people): Split creator and reviewer into different people, even if it’s just “you check my stuff, I check yours.” Add one admin. Clients approve via a no-login link, no seats used.
Growing agency (8 to 20 people): Add dedicated designer and content roles. Consider one senior reviewer per pod or per few clients, someone whose job is specifically to catch mistakes before they reach the client stage. Keep publish access limited to account leads.
Bigger agency (20+ people): Functional teams, clear escalation for anything unusual (a sensitive post, a legal question), and a real onboarding process for new hires so nobody’s guessing what they’re allowed to touch.
Setting this up without overthinking it
You don’t need a permissions committee meeting. Start rough, adjust as you go.
- List the actual people on your team and what job each one does day to day.
- Match each person to one of the five basic roles above. Most people fit one cleanly.
- Turn off publish access for anyone who isn’t a team lead or account manager.
- Send clients an approval link, not a login. Keep their view to just what they need to see.
- Revisit this every few months, or whenever someone new joins. Roles drift as teams grow, and it’s easy to forget someone still has access from a job they left six months ago.
Kontentino’s role system covers this out of the box: Admin, Manager, Client, Designer, Translator, and a limited Media Agency role for partner agencies working on the same account. Each one sees only what its job requires. Check the full breakdown in our help center if you want the specifics.
Want your team’s roles set up properly from day one? Start a free 14-day trial, no card required, or book a demo and we’ll walk through your team’s setup with you.
FAQ: social media roles and permissions
Who should approve social media posts?
Whoever owns the outcome if something goes wrong. Usually that’s an account manager or the client themselves for client work, or a marketing lead for in-house teams. The person approving shouldn’t be the same person who wrote the post, otherwise you’ve just got one person checking their own work.
What roles does a social media team need?
At minimum: someone creating content, someone reviewing it internally, and someone giving final approval. Bigger teams add designers, translators, and admins. Not every role needs a separate person, but each job should exist somewhere in your process.
Should clients have edit access to social posts?
Usually no. Give clients a clean approval view instead: they see the finished post, comment or approve, and that’s it. Full edit access invites confusion about who’s actually responsible for the final version.
How many people should be able to publish posts?
As few as possible, ideally just team leads or account managers, and only after a post has cleared approval. Wide publish access is how typos and half-finished drafts end up live.
What’s the difference between pod and functional team structures?
Pod teams own a group of clients from start to finish, good for smaller agencies where personal relationships matter. Functional teams split by job (content, review, account management) across all clients, which scales better once you’re past 15 to 20 accounts.
Get roles right from the start
A clean permission setup isn’t glamorous, but it’s the difference between a smooth Friday afternoon and an apology email. Kontentino’s built-in roles handle the split for you: creators, reviewers, clients, and admins, each seeing exactly what they need.
Try it free for 14 days, no credit card required, or book a demo and we’ll help you map your team onto it.
