Roles and permissions
The four RankX AI roles, what each can do, why only one can approve an MCP connection, and why Agency Clients do not consume seats.
RankX AI has four roles. Three of them are your team and one is your client, and that split is the boundary everything below sits on.
Agency Owner is the billing authority, and every agency always has at least one. Agency Admin is staff with access to every Client Workspace and to the agency's own administration. Member is staff who do the work: they create and delete Websites, run checks and manage content, and they do not reach the Agency Admin area. Agency Client is an external user of one Client Workspace, with a white-labelled experience.
Most of a team is on Member. It is the role to invite someone into unless they need to configure the agency itself.
What each role can do
| Agency Owner | Agency Admin | Member | Agency Client | |
|---|---|---|---|---|
| See every Client Workspace | Yes | Yes | Yes | No, only their own |
| Add and remove Websites | Yes | Yes | Yes | No |
| Run checks, audits and research | Yes | Yes | Yes | No |
| See the credit balance | Yes | Yes | Yes | No |
| Reach the Agency Admin area | Yes | Yes | No | No |
| Configure a workspace's permissions | Yes | Yes | No | No |
| Set per-client credit budgets | Yes | Yes | No | No |
| White label settings | Yes | Yes | No | No |
| Billing and subscription | Yes | No | No | No |
| Issue or approve an MCP credential | Yes | No | No | No |
| Consumes a staff seat | Yes | Yes | Yes | No |
Member is genuinely staff, not a read-only role. Someone on it can delete a Website, spend credits and publish to a connected site. What it cannot do is configure the agency: clients, permissions, budgets, white label, team and MCP all live behind the Agency Admin area, and Member is denied it.
An agency always has an owner, enforced
The database refuses to remove or demote the last Agency Owner on an agency, so one can never end up with none. That is a trigger rather than a convention, and the error it raises says so.
It does not forbid a second owner, and it is worth knowing which of those two things is guaranteed: what the product protects is that billing and credential issuance always have somebody who can do them, not that only one person can.
Two capabilities sit with the Owner role alone, and both for the same reason: they are the two ways to commit money or capability that nobody else can withdraw.
Billing. Plan changes and payment.
MCP credentials. Issuing a personal access token, or approving an OAuth connection, creates a credential that can spend credits and edit a live public website. Its scopes are fixed at issue and cannot be narrowed afterwards. See MCP authentication.
Agency Clients do not consume seats
Your plan's seat limit counts staff: Agency Owners, Agency Admins and Members. An Agency Client is an external portal user for one workspace and does not count against it.
This is a deliberate shape rather than a generosity. A feature whose purpose is for clients to log in and see their own numbers should not be priced so that you ration it, so inviting a client's marketing manager costs nothing.
Agency Clients are not staff, anywhere
Worth stating plainly, because it is the boundary the whole model rests on: an Agency Client is not staff, and no code path treats it as such.
The practical effects:
- They see one workspace, and only the sections that workspace permits.
- They cannot reach settings that belong to the agency.
- They cannot see other clients, or that other clients exist.
- Guards run on the page as well as on the navigation, so typing a URL directly does not get past a hidden section.
That last one matters: a hidden nav item is a convenience, not a boundary, and RankX AI treats it as such.
The seven client-visibility permissions
Separately from roles, each Client Workspace carries seven switches deciding which sections its Agency Clients see. They govern the client experience, not your team's: staff are never filtered by them.
The set is closed at seven, and two surfaces are deliberately ungoverned. See what clients can see.
Inviting people
Staff are invited to the agency. Choose the role deliberately: Member for someone who will do the work, Agency Admin for someone who will also configure clients, permissions, budgets or white label.
Agency Clients are invited to a specific Client Workspace. Set that workspace's visibility permissions before the invitation, because an absent permission means allowed: an unconfigured workspace shows the client everything.
Removing someone
Removing a person revokes their access on their next request rather than at some later sweep.
It also revokes MCP credentials they created. A token issued by someone who has left the agency stops working, which is the behaviour you want and worth knowing before you remove the person who set up your integrations.
Where to go next
- What clients can see, for the seven permissions.
- The client portal, for what an Agency Client actually gets.
- Team and seats, for the seat limits.
Client Workspaces
One workspace per client in RankX AI. What a workspace holds, how the Website pool works, and what happens when you remove one.
What clients can see
The seven per-workspace switches deciding which sections an Agency Client sees, why absent means allowed, and the two surfaces that are ungoverned.