Who has admin

Ask a small advertiser who has administrator access to their advertising account, and watch the pause before the answer.

Usually the answer is a list. The person who built it, who left. An agency let go two years ago. A freelancer hired for one project. A founder's cousin who set up the payment method and never took his name off it. The current team, all of them, because that was easier than deciding which of them needed it.

Access gets given the way a spare key gets given. One at a time, each time for a good reason, and nobody has ever asked for one back.

Then something changes across forty campaigns on a Tuesday evening, and by Thursday the meeting is trying to explain a result that cannot be attached to a decision. The log has a name on it. The name belongs to a shared login, or to somebody who was doing what he was asked to do by a person who is not in the room.

I used to file this under security. It belongs under management. The cost is not fraud. The cost is that a change with no author cannot be reviewed, and a team that cannot review its changes has to learn the same thing twice, at full price, every time.

Governance in a small team does not need a policy document. It needs one sentence: this account has one person who makes changes and one person who reviews them, and everybody else asks. Two names, written down, revisited when the people change.

Administrator access is the cheapest thing a founder ever gives away, because on the day it costs nothing. It gets charged later, in a quarter that ends badly for reasons nobody can reconstruct.