SEO agency contracts: which permissions to grant and which deliverables to receive

Add the SEO agency's accounts as a Full user in Search Console, a property-level Marketer in Analytics and an Editor in WordPress, and keep the Owner and Administrator roles on company accounts even during the contract.

If you separate, for each of Search Console, Analytics, WordPress and your ads account, the permissions the company keeps from those it hands to the agency, getting permissions back after the contract ends takes fewer steps.

1. Permission levels to give an SEO agency

During the pre-contract audit stage, give the agency read access only, and after the contract is signed, raise it to the level needed to submit sitemaps and publish posts. In its Do you need an SEO? document (updated June 11, 2026), Google advises that when a firm offers an audit, "don't grant write access at this stage." So during the audit stage, add the agency's account to Search Console as a Restricted user.

The same document states: "SEO firms that access your server through FTP should explain all changes to your website." Ask an agency that has server access to list the files and settings it changed on the server in the change log as well. An agency can also verify Search Console ownership through server access or Tag Manager publish permission, so every month the company checks the ownership history in Users and permissions for new owners.

2. Dividing permissions in Search Console, Analytics and the CMS

Keep the roles that can change other users' permissions on company accounts, and give the agency no more than the levels in the table below.

According to the permissions table in the Manage users, owners, and permissions help article, only owners can add users, while full users can also remove URLs and disavow links.

According to the Manage access and data restrictions help article, a role granted at the account level is inherited by every property in that account. The Verify your site ownership help article states that a user with Analytics edit permission (now the Editor role) can verify Search Console ownership using the site's Analytics tag. So do not give the agency's account an account-level role or the Editor role; give it the Marketer role on the property it works on.

The WordPress documentation page Roles and Capabilities (updated September 2, 2026) defines an Editor as "somebody who can publish and manage posts including the posts of other users." On a single site, installing plugins and managing users are capabilities that only an Administrator has.

According to the table in the About access levels in your Google Ads account help article, Standard access lets a user edit campaigns and billing information, but not grant account access or change access levels.

3. What goes wrong when you hand over owner permissions

An agency with owner-level access can remove the company's account from the property, and an agency that verified ownership with its own token can verify ownership again, even after the company removes its account, until the token is deleted. Search Console Help states that removing an owner from a property "does not delete or revoke the verification token."

If an SEO firm already has owner-level access, clean this up from the company account in the following order.

1. In the Ownership verification row of Search Console settings, check whether the company account is a verified owner; if it is not, complete ownership verification with the company account from that row. The Users and permissions page is shown only to property owners. If the agency's account is an owner of a Domain property, verify ownership of the Domain property with the company account through a DNS record as well, then carry out steps 2 to 5 on the Domain property first.
2. In Users and permissions, if the agency account's row shows Owner without Verified, use Change permission to downgrade that account to Full user.
3. If the agency account's row shows Verified, its level cannot be lowered, so remove that account's access.
4. Find that account's token in the list of unused ownership tokens, and first check whether the same token is also used for ownership verification in Merchant Center or Google Workspace. The help article warns that deleting such a token can negatively affect other services that use it. Then delete the HTML file or meta tag from the site and the DNS record from the domain management screen; if the Analytics method was used, revoke that account's Analytics edit permission, and if the Tag Manager method was used, revoke its publish and admin permissions.
5. After removing every verification method, add that account back as a Full user, and keep the company account as the only owner.

4. Deliverables to receive every month and at the end of the contract

Write into the contract that the company receives a change log, a list of published content and a monthly report every month, and the full change history and a keyword map when the contract ends.

Every month, use the external links column in the list of published content to check whether any links to the agency's site have been added. The same Google document warns: "You shouldn't link your site to the SEO firm."

If the change log includes fixes to bot access, status codes, index-blocking tags, canonical URLs or Core Web Vitals, the company checks whether they were applied using the verification methods and pass criteria in Essential technical SEO checks: a checklist to hand to your developers.

5. Permission and deliverable clauses to write into the contract

The company puts clauses in the contract covering the permission level for each account, when each deliverable is received, and the procedure for deleting the agency's accounts and ownership verification methods when the contract ends. In the permissions clause, write the levels from the table in section 2, together with a condition that URL removal, link disavowal and billing edits, which the agency can perform even at those levels, are carried out only after the company approves. In the deliverables clause, state who holds the copyright in published content after the contract ends. At the quote stage, use the deliverable ownership item in How to compare SEO agency quotes beyond price to check whether the quote includes this.

In the termination clause, set out the procedure for deleting unused ownership tokens and WordPress accounts. When deleting a WordPress account, follow the Users Screen document (updated October 23, 2024) and choose the option on the deletion screen that attributes the posts and links to a company account. If you choose a different option, the posts and links are deleted too.

In PION's GEO agency service too, the client holds the rights to the domain. PION receives the access and management permissions needed for the work from the client, publishes content to a blog connected to the client's domain through DNS, and provides a report every month. PION assigns the copyright in content that has been paid for to the client, and when the contract ends, it hands the operating permissions and accounts over to the client.

The four stages of PION's agency service and its fixed-fee, performance-based and hybrid pricing are described in the GEO agency service overview. If you answer the 8 questions in the AI answer visibility basics check, the results screen shows readiness scores for four areas, including AI search bot access and owned publishing, along with your weak areas.