By Alpit Patel and the aibrevo team · October 13, 2026 · 6 min read
GoHighLevel User Roles and Permissions: Who Can See What
GoHighLevel user roles work on two layers. User type (Agency or Account) decides which sub-accounts a person can enter. Role (Admin or User) plus module and granular permissions decide what they can do inside. To restrict someone, set their type to Account, assign only their sub-accounts, then switch off modules and turn on Only Assigned Data.
Part of the guide: GoHighLevel setup guide
Key takeaways
- Two separate settings control access. User Type (Agency or Account) decides which sub-accounts someone can enter. Role (Admin or User) with module and granular permissions decides what they can do once inside.
- An Account-type user can open only the sub-accounts you assign. An Agency-type user can reach every client account under the agency, so reserve it for your own staff.
- HighLevel's agency permissions article (modified October 6, 2026) lists more than 30 modules you can switch on or off per user, from Contacts and Calendars to Payments and Sub-Account Transfers. Disabling a module blocks everything inside it.
- Only Assigned Data limits a user to records assigned to them. It is not the same as turning a module off.
- Review the sensitive permissions on a schedule: creating and deleting sub-accounts, sub-account settings, user management, Login As, dashboard export and sub-account transfers.
How do GoHighLevel user roles work?
GoHighLevel user roles work on two layers. The first layer is User Type, Agency or Account, which decides which sub-accounts a person can enter. The second is Role, Admin or User, together with module and granular permissions, which decide what they can do once inside. HighLevel’s agency article says it directly: assignment controls entry into an account, and permissions control what the user can do inside it.
This is step 1 of the setup guide because every later task, from phone settings to workflows, depends on who is allowed to touch it. If you are new to the account structure itself, start with sub-accounts explained.
Two layers of access
- Layer 1, User Type: Agency (all client accounts) or Account (only the accounts you select).
- Layer 2, Role: Admin (administrative capabilities within that scope) or User (only what you configure).
- Layer 3, Modules: switch whole features on or off, such as Contacts, Calendars, Payments.
- Layer 4, Granular and data scope: individual actions, plus Only Assigned Data to limit records.
What is the difference between Agency and Account user types?
An Agency user can access every client account under the agency. An Account user can access only the sub-accounts you assign. HighLevel’s User Access article (modified October 6, 2026) adds that for Agency users you also choose which accounts they receive notifications for.
| Agency user | Account user | |
|---|---|---|
| Reaches | All client accounts under the agency | Only the sub-accounts selected |
| Typical person | Your own staff and owner | A client’s team, a contractor, a location manager |
| Sees agency view | Yes, within their role | No |
| Risk if over-granted | Exposure of every client’s data | Exposure of one account’s data |
A common mistake is giving a client or contractor the Agency type because the form is easier. Use the Account type for anyone outside your own team, and for staff who only serve specific clients. HighLevel also has a separate article for creating a user or admin who manages several locations without agency access: choose Account type and assign multiple sub-accounts.
What is the difference between Admin and User roles?
Admin has administrative capabilities within the person’s access scope. User gets access based on the permissions you configure. HighLevel’s User Access article does not define the two roles in detail and links to a separate article, so what follows is limited to what its agency article states.
An Account-type Admin can manage most settings in the assigned sub-accounts (per HighLevel’s older multi-location article, modified May 2025), while an Account-type User is limited by the toggles you set. Scope still matters: an Account-type Admin is an admin of the assigned accounts only, not of the agency.
How do I add a user and invite them?
In Agency View, go to Settings > Users, click Add User, and complete the form (HighLevel, modified October 6, 2026). HighLevel’s older article calls this screen the Team tab under Settings, so use whichever your account shows. An invitation email goes to the user’s address when you save.
- Switch to Agency View and open Settings > Users.
- Click + Add User and enter name, email and the required details.
- Open Roles & Permissions.
- Set User Type: Agency, or Account for anyone who should see only some sub-accounts.
- For Account, search for and select only the sub-accounts they need.
- Choose the Role, Admin or User.
- Configure modules and individual permissions (next section).
- Optionally enable Only Assigned Data.
- Click Save.
To add a user inside one sub-account instead, open the sub-account and go to Settings > Users. You can also set call-forwarding defaults and voicemail during creation, which links to the phone number setup guide. If the email already exists in the agency, HighLevel suggests contacting the agency admin or adding the existing user from Users.
Which permissions can I switch on or off?
HighLevel’s agency article lists modules you can turn on or off per user, including AI Agents, Account Settings, Account Tools, Automation, Blogs, Calendars, Certificates, Communities, Contacts, Conversations, Dashboard, Forms, Funnels, Integrations, Launchpad, Marketing, Media, Memberships, Opportunities, Orders, Payments, Payment Settings, Products, QR Codes, Quizzes, Reputation, Subscriptions, Sub-Account Transfers, Surveys, Taxes, Transactions and WordPress. The controls you see depend on user type, role and enabled features. A disabled module blocks all functionality inside it.
Granular permissions control individual actions inside supported modules. The article names these:
| Permission | Notes from HighLevel |
|---|---|
| Create Sub-Accounts and Delete | In the Sub-Accounts module |
| Sub-Account Settings | Sub-accounts list page, Manage Client page (basic details), sub-account billing, sub-account company settings |
| User Management: Enable Login As | Enabled by default for eligible admins; can be turned off |
| Dashboard: Export data | Controls who can export |
| Sub-Account Transfers | By default only the Agency Owner; can be granted to specific Agency Admins |
| Pay Affiliate Manager Payout | Admins only; on by default for Agency Admins and can be turned off |
| API User Management | View and Manage Users, View Users |
| View and manage Forms, Surveys, Quizzes, QR Codes | Per-module action control |
| Only Assigned Data | Limits record visibility to assigned records |
HighLevel states it does not give a full list of granular permissions for every module, so check the screen for the module you are restricting.
What should each role in a small business be able to do?
HighLevel does not publish a recommended role matrix, so the table below is our suggested starting point for a small business. It is an opinion, not documentation. Adjust it to your team.
| Person | User type | Role | Suggested modules | Only Assigned Data |
|---|---|---|---|---|
| Owner | Agency or Account | Admin | All | Off |
| Office manager | Account | Admin or User | Contacts, Conversations, Calendars, Opportunities, Forms | Off |
| Sales rep | Account | User | Contacts, Conversations, Calendars, Opportunities | On |
| Receptionist | Account | User | Contacts, Conversations, Calendars | On |
| Marketing contractor | Account | User | Marketing, Funnels, Media, Forms | Not needed |
| Bookkeeper | Account | User | Payments, Transactions, Orders | Not needed |
Sales reps who work their own leads are the common case for Only Assigned Data. Pair it with a pipeline owner field and your pipeline and contact setup, because assigned-data filtering only helps if records are assigned.
How do I lock down the sensitive permissions?
Review sensitive permissions on a schedule. HighLevel recommends periodic review of sub-account creation and deletion, Sub-Account Settings, User Management, Login As, dashboard exports and transfers. Also:
- Keep Enhanced Security enabled (Agency View > Settings > Company > Advanced Settings) unless a required workflow depends on API user-management operations. HighLevel says disabling it increases security risk.
- Turn off Login As for admins who do not need it.
- When a person leaves, remove them from Settings > Users the same day, then check any workflow or calendar they were assigned to.
- For white-labeled agencies, remember that clients see what you give them. See the white-label guide and the agency guide for structure.
If you want this designed as part of a full build, the GoHighLevel setup agency page describes what a scoped setup covers.
Sources
- HighLevel Support: Manage Agency User Roles and Permissions in HighLevel (modified October 6, 2026): user types, roles, modules, granular permissions, sensitive permissions. Checked on 2026-10-13.
- HighLevel Support: User Access (modified October 6, 2026): Agency vs Account, add-user paths, Login As path. Checked on 2026-10-13.
- HighLevel Support: How to create a user or admin to manage multiple locations without agency access (modified May 21, 2025): Team tab path, invitation email, Account Admin behavior. Older article; menu labels may have changed. Checked on 2026-10-13.
- Not verified: HighLevel’s separate “Admin vs. User Roles and Permission Scopes” and sub-account permissions articles were not opened, so the role matrix above is our own suggestion.