User permissions control what each person can do in GoHighLevel. Every user has a type and a role:
- Type: Agency users can work across all sub-accounts under the agency. Account users only see the sub-accounts they're assigned to.
- Role: Admins can manage settings, while users are limited to day-to-day work.
On top of that, each user has feature-by-feature permission toggles (contacts, conversations, opportunities, workflows, settings, payments and more) and options that limit them to only the contacts, conversations and opportunities assigned to them.
In practice
Users and permissions are managed in Settings, under Users, either in the agency view (for agency users) or inside a sub-account (as of October 2026). Edit a user to change their role, which sub-accounts they can access, and their permissions.
For agencies, the pain is volume and reversibility. Onboarding a client with ten reps means creating ten users and setting the same permission grid ten times. Off-season pauses, a rep on leave, or a client behind on payment all raise the same question: how do you switch access off now and put it back exactly as it was later, without writing down every toggle first?
Review access regularly. Users who left the business, extra admins, and seats nobody logs into are both a security risk and wasted cost.
Where it shows up in RGS Tools
Sub-Account Manager's bulk user creator creates many users at once with roles and a permissions grid. The user and permission manager changes roles in bulk, or pauses access and restores it exactly as it was. Backup & Insights's usage analytics shows idle seats per sub-account and per user.