Guide
Team Product Scope
Combine role permissions with the products the member is allowed to manage.
Two checks, not one
A permitted action still needs the relevant product scope. A product assignment does not by itself grant every operational or financial permission. Test both dimensions when reviewing team access.
Some account-wide settings require broader scope and specific view/manage permissions. For example, GA4 settings require the appropriate settings permission and all-product scope; assignment to one product is not enough.
Review changes
Use supported role/scope updates and member removal. Confirm later sessions and requests honor the new access. Do not share the owner account to bypass a member restriction or place owner tokens into client packages.
Scope values and complete updates
The two scope modes are all_products and selected_products. For selected_products, send the complete selectedProductIds array on every member update, even when changing only the role. An empty or omitted selection is rejected. Membership updates revoke existing sessions; a new sign-in may be required.