Manage team roles across SGEN sites

| Field | Value ||---|---|| Audience | sgen-admins || Page type | tutorial || Area | Documentation || Updated | 2026-05-27 |

How to assign roles to team members across one or many SGEN sites

Every person who touches your SGEN account has a role. Roles control exactly what that person can see and change — nothing more, nothing less. SGEN has seven named roles. Each role maps to a specific type of work. Assigning the right role to the right person is a five-minute task in SG-Dashboard. Getting it wrong creates either a security gap or a workflow bottleneck — usually both.

This guide covers the role matrix, how to assign roles on a per-site basis, and how Platform Admin authority works across multiple sites in one account.

What is this for?

Read this guide when you are setting up team members on a new site, reorganising access after a staff change, or troubleshooting a permissions complaint. It is also the reference to reach for when someone asks "who can publish?" or "why can't I access Settings?"

If you are sending the first invite, read Invite collaborators alongside this guide. That page covers the invite flow itself. This page covers what role to give each person once they are in.

Good use cases

• An agency onboarding a client's content team to a new site and needing to know which role to assign a content writer versus a developer.
• A multi-brand company adding a new regional editor and needing to confirm that editor cannot access the primary brand's site.
• A Platform Admin auditing role assignments after a team member leaves.
• A site owner who wants to give a freelance SEO consultant access to one site without exposing billing or other sites.

What NOT to use this for

• Do not use roles as a substitute for site isolation.

If a team member should never see Site B, do not assign them a low-permission role on Site B. Assign them no role on Site B. No role means no access — not read-only access.

• Do not use the Platform Admin role for day-to-day editorial work.

Platform Admin is an escalation role. Assigning it to a content editor because it is "easier" removes all meaningful access control from your account.

• Do not treat roles as permanent.

When a contractor finishes, revoke their role. When a staff member moves teams, reassign their role to match the new work. The Members panel in SG-Dashboard makes both operations a one-minute task.

How this connects to other features

• Set up a multi-site deployment — roles are assigned after sites exist.

Read that guide first if your sites are not yet created.

• Invite collaborators — the invite flow that creates a member record.

Roles are assigned during the invite; they can be changed without re-inviting.

• Agency client routing — agencies operating under the agency tier have additional routing that interacts with role scope.
• SG-Dashboard Members — the surface where role assignments live.

Before you start

Confirm you have the authority to assign roles on the sites in question. Only users with the Owner role or higher on a site can change role assignments for that site. Platform Admins can assign roles across all sites on the account.

List the team members you are assigning and what each person's job is. The role-to-job mapping in this guide maps cleanly to typical team structures. If someone's job does not match any of the seven roles, choose the role that limits their access to what they need — never choose up.

Where to go

Open SG-Dashboard and click Members in the left sidebar. The Members panel shows all users on this account with their current role and the sites they are assigned to.

To assign a role on a specific site, click the site name in the left sidebar first, then open Members inside that site's panel. Site-scoped Members shows only the users assigned to that site.

Steps — Assign and manage team roles

1. Review the seven-role matrix before assigning

Read the role descriptions below in full before opening the invite or edit form. Assigning roles without knowing the permission boundary of each one is the most common cause of access complaints.

The seven canonical SGEN roles are:

Content Editor A Content Editor creates and edits pages, blog posts, and other content objects on the sites they are assigned to. They can publish their own content. They cannot change site settings, manage other users, or access billing. Assign this role to writers, editors, and content coordinators.

Marketing Manager A Marketing Manager has all Content Editor permissions plus access to marketing surfaces: forms, email campaigns, landing pages, and analytics. They can create and publish marketing content and view traffic and conversion data. They cannot change technical site settings or manage users. Assign this role to in-house marketing team members responsible for traffic and lead generation.

SEO Specialist An SEO Specialist can edit SEO metadata, manage redirects, and view analytics for the sites they are assigned to. They can edit page titles, descriptions, and URL slugs. They cannot publish new pages or change content beyond SEO fields. Assign this role to external SEO consultants or in-house SEO team members.

Developer A Developer has access to custom code surfaces: custom codes, theme editor, and advanced site settings. They can modify the design system, add custom scripts, and change technical configuration. They cannot manage users or access billing. Assign this role to in-house developers and trusted agency technical staff.

Ecommerce Manager An Ecommerce Manager has access to the ecommerce surfaces: products, orders, discount codes, and ecommerce settings. They can manage the full product catalog, process orders, and configure shipping. They cannot access non-ecommerce content or change site settings outside the ecommerce scope. Assign this role to ecommerce coordinators, store managers, and fulfillment leads.

Support Agent A Support Agent has read access to orders, customer records, and form submissions on the sites they are assigned to. They can view order history and customer contact information. They cannot create, edit, or publish content, and they cannot change any settings. Assign this role to support staff who need visibility into customer activity without the ability to change anything.

Platform Admin Platform Admin has unrestricted access to all sites on the account, all settings, and all users. This role is intended for account owners and technical leads who need to make cross-site configuration decisions. Platform Admin can override per-site Owner assignments, manage billing, add and remove users across all sites, and access all content and settings on every site. This is the escalation role — see the escalation section below for when to use it.

2. Open the Members panel for the correct site

In SG-Dashboard, click the site you are configuring in the left sidebar. Open the Members tab inside that site's panel.

If you are assigning a Platform Admin role, do this from the top-level Members panel in SG-Dashboard, not from inside a specific site. Platform Admin is an account-level role and does not appear in per-site Members panels.

Confirm the list shows the current members and their roles for this site. If the person you are assigning is not yet in the list, they have not been invited yet. Go to Invite collaborators first, then return here to verify the role was set correctly during the invite.

3. Assign or change a role

Click the member's name or the Edit action beside their row. The member detail panel opens.

In the Role dropdown, select the role that matches the person's job on this site. Use the matrix from Step 1.

If the person works across multiple sites and needs a different role on each one, this assignment applies only to the currently selected site. To assign a different role on a second site, open that site's Members panel and repeat this step.

Click Save changes. The role change takes effect immediately. The member does not need to log out and back in — their next page load inside SG-Admin will reflect the updated permissions.

4. Verify the assignment

After saving, confirm the assignment is correct by returning to the Members list and reviewing the Role column for that member. The list updates immediately.

For sensitive role changes — granting Developer or Platform Admin access — open a second browser tab and log in as the member (if you have test credentials) or ask the member to confirm what they can see after their next page load. A Developer should see the custom code and theme surfaces in the site's SG-Admin navigation. A Support Agent should see only orders and form submissions — no content editing options.

If the role is not reflecting correctly after five minutes, log the member out and ask them to log back in. Role changes propagate on page load; a stale session can hold the old permission set for the duration of the session.

5. Cross-site role audit (recommended for multi-site accounts)

After assigning roles on a new site, run a quick audit across all sites to confirm no member has wider access than they should.

In SG-Dashboard, open the top-level Members panel. Filter by role using the Role dropdown. Check the Developer and Platform Admin rows in particular — these two roles carry the most access.

For each Developer and Platform Admin, confirm:

• This person currently works on this account.
• This person needs this level of access.
• Former contractors and departed staff are not in this list.

Revoke access for anyone who should not have it. Click their name, click Remove from account, and confirm. Removal is immediate.

Platform Admin escalation paths

Platform Admin is not a role for everyday use. It exists for situations where per-site ownership alone cannot resolve a problem.

These are the legitimate escalation scenarios:

Cross-site configuration conflict. A setting on Site A is blocking correct behavior on Site B — for example, a shared domain or shared media library configuration that sits above the per-site level. A Platform Admin has the authority to change settings at the account level and on both sites simultaneously. A per-site Owner cannot.

User locked out across all sites. A member's account has a problem that is not resolvable from any individual site's Members panel. A Platform Admin can access the account-level user record, reset access, and restore the member's session.

Role reassignment after a team departure. When a site Owner leaves and the account has no other Owner on that site, no one on that site can reassign the departed Owner's access. A Platform Admin can step in, reassign or revoke the departed member's role, and assign a new Owner.

Billing and plan changes. Billing is accessible only to Platform Admins. When a site's plan needs to change — adding a site, upgrading the plan tier, updating the payment method — the Platform Admin makes that change in SG-Dashboard under Billing. No per-site role has access to billing.

Emergency content lock. If a content incident occurs on one site — published content that should not be live — a Platform Admin can remove it from any site without needing to be a named member of that site. This is faster than coordinating with the per-site team in an emergency.

What success looks like

When roles are correctly assigned, each of the following is true.

• Every active member appears in the Members list with a named role.
• No member has a role that grants access beyond their job scope on that site.
• Platform Admin is held by two people at most — usually the account owner and one technical backup.
• Former team members, departed contractors, and completed project collaborators appear nowhere in any site's Members list.
• The Members filter for Developer and Platform Admin returns a short, intentional list.

What to do if it does not work

A member says they cannot access a feature they should have access to. Open the site's Members panel and check their role. Confirm the role shown in the panel matches the role the member expects. If the role is correct but access is still missing, ask the member to log out and log back in — role updates apply on page load, not mid-session. If the issue persists after a fresh login, open a support request.

A member has more access than they should. Open the site's Members panel. Click the member's name. Change their role to the correct one and save. The change is immediate. If the member should have no access at all to this site, use Remove from site rather than a lower role.

Platform Admin is assigned to the wrong person and that person's account is inaccessible. Contact SGEN account support. Platform Admin recovery requires verification of account ownership outside the normal in-app flow.

A role change is not reflecting after five minutes. Log the affected member out and ask them to log back in. If the problem persists, check whether the member is logged into more than one device — each device holds a session and each session has cached permissions that refresh on login.

No one on a site has the Owner role. A site without an Owner is not automatically broken, but no one on that site can add or change users. A Platform Admin can step in from the account level. If no Platform Admin exists on the account, contact SGEN account support.

Tips for clean role management

Assign roles at invite time, not after. The invite form includes a role selection. Setting the role during the invite means the member lands in their correct permission scope from their first login. Inviting someone without a role and assigning it later creates a window where the member can see the site but cannot do anything — which generates support requests.

Use SEO Specialist for external consultants. External SEO agencies and freelance consultants only need access to metadata and analytics. The SEO Specialist role covers exactly that. Giving an external consultant a Marketing Manager role because it is the next available option exposes your form data and email list to a third party.

Do not share Platform Admin credentials. Each Platform Admin should have their own account with their own email address. Shared credentials make audit logs unreadable — every action shows the same user, and you cannot determine who made a change when something goes wrong.

Review the Members list every 90 days. Team composition changes. Contractors finish. Staff move between departments. A quarterly review of the Members list is the minimum hygiene required to keep role assignments accurate.

## Related reading

Topic
Invite collaborators
Set up a multi-site deployment
Agency client routing
SG-Dashboard site manager
Client Manager