Finance needs the numbers. Legal needs the contracts. Campaign managers need campaigns, and some people only need to look. Invite each one with the right role.
What’s in it
Owner, Admin, C-suite, Campaign manager, Finance, Legal, Member and Viewer.
Cap how many campaigns one person can run.
Nobody shares a password.
Change someone’s role when their job changes, and remove them when they leave.
How it works
Choose their role as you invite them.
Add a campaign cap if you want one.
Resend the invite if it gets lost.
Roles move with people.
Works with
Run several client brands separately, with access set per person and per brand.
Approval ChainRoute creator choices, budgets, content and payments past everyone who has to sign them off.
CampaignsCreator campaigns where every click, sign-up and sale is credited to the creator who drove it.
More in Agree and run the work
One login shared by six people is normal.
The legal team can accidentally touch something they were only supposed to review. A new employee gets the same access as the person who has run the account for three years.
And the person who left may still have access until somebody remembers to change it. The obvious answer is individual logins. But individual logins without proper roles create another problem.
Everyone gets the access their job needs.
Team lets you invite colleagues into your Klairova account with their own login and a role that matches what they actually do.
The account. Full control, including billing and removing other people. There should be very few of these.
Runs the account day to day. Can manage campaigns and the team. The person you trust to keep the account moving.
Senior visibility across the account without day-to-day operational control. For executives who need to know what is happening without needing to run it themselves.
Creates and runs campaigns. The working role for the people actually managing creator marketing.
They can see the financial information they need without needing to edit a campaign brief.
The people who need to see what was signed without needing to run marketing.
General access for someone involved in the work who does not own a specific function.
Read only. For stakeholders who need visibility but should not be able to change anything.
Your finance colleague does not need to edit campaigns.
Your lawyer does not need to run creator outreach. Your CEO does not need to build a campaign. Your campaign manager does not need access to billing. And someone who only needs to see the numbers does not need permission to change them. Give each person the role that matches their job. Start narrower than feels necessary.
Widen access when they actually need it.
Roles control what someone can access.
And it makes an overloaded team member visible before they become the reason something slips. If someone is running five campaigns and their cap is five, you know they are at capacity. That is useful information before another campaign lands on their desk.
No shared credentials.
People move.
INVITE, ASSIGN, AND REMOVE CLEANLY.
Send the invitation to the person who needs access. They join with their own login. No shared credential is created.
If they are a campaign manager, set the maximum number of campaigns they can run.
Until they accept the invitation, they remain pending and do not have access.
Invitations get buried. Resend the invitation rather than creating a new one.
A person's role can change as their responsibilities change.
One action. Their access ends. No password rotation for everyone else.
Marketing, finance, legal and leadership can work in the same account without everyone receiving the same access.
Editorial, commercial and finance teams can have separate access instead of sharing credentials.
Team roles work within a brand account. If you manage several client brands and need separation between each client, Workspaces adds that layer on top of Team.
Your accountant needs invoices, payments, payouts and budgets. They do not need to edit a campaign. Give them the Finance role. They can do the financial work without receiving the keys to the marketing operation.
They can see what is happening without becoming another operator inside the account.
Team controls who can do what inside one brand account.
Workspaces handles a different problem. An agency may manage five client brands. The people working on Client A should not automatically have the same access to Client B, C, D and E. Workspaces creates that separation between client brands. Team controls the people inside. Workspaces separates the clients.
Explore Workspaces
"Who needs to approve this before it moves forward?" Those are different problems. A campaign manager can have permission to create a campaign. Approval Chain can still require the brand manager, CMO or finance lead to approve different stages before it proceeds. Access control and approval control work together.
Explore Approval Chain
Campaign managers are the people who actually run campaigns.
Legal needs access to the agreements.
They do not necessarily need access to every part of the marketing operation. Give them the Legal role. They can review agreements, licences and usage terms without being given campaign-management responsibilities.
Explore Agreement
| Klairova Team | Shared login | |
|---|---|---|
| Individual login per person | Yes | No |
| Role-based access | Yes | No |
| Eight defined roles | Yes | No |
| Finance-specific access | Yes | No |
| Legal-specific access | Yes | No |
| Executive visibility | Yes | No |
| Read-only access | Yes | No |
| Campaign manager role | Yes | No |
| Per-person campaign cap | Yes | No |
| Individual invitations | Yes | No |
| Remove one person without affecting others | Yes | No |
| Need to rotate a shared password when someone leaves | No | Yes |
Individual accounts solve the shared-password problem.
Roles solve the access problem.
| Klairova Team | Everyone as Admin | |
|---|---|---|
| Individual login | Yes | Yes |
| Role-based access | Yes | No |
| Finance role | Yes | No |
| Legal role | Yes | No |
| C-suite role | Yes | No |
| Campaign manager role | Yes | No |
| Viewer role | Yes | No |
| Read-only access | Yes | No |
| Per-person campaign cap | Yes | No |
| Least-access approach | Yes | No |
| Different access by job | Yes | No |
START NARROW.
Widening access later takes one action. Discovering that somebody had access they should never have had is a much harder problem. KEEP OWNERS TO A MINIMUM. An Owner has full control, including billing and removing other people. Most people who feel senior enough to be an Owner should probably be an Admin or C-suite.
Giving someone the Legal role does not mean they automatically approve every legal decision. Access and approval are separate. That is what Approval Chain is for. CAMPAIGN CAPS ARE ABOUT CAPACITY. A campaign limit is not just a permission control. It can also show when somebody is carrying too much work.
TEAM IS PER BRAND ACCOUNT. Team controls people inside a brand account. If an agency needs separate teams and access across multiple client brands, use Workspaces as well. CHANGE ROLES WHEN JOBS CHANGE. The role someone needed when they joined may not be the role they need six months later.
Individual access makes this straightforward.
Team lets you invite colleagues into your Klairova account with their own logins and assign them roles that match their responsibilities.
Yes. Team is designed so colleagues access the account through their own login rather than sharing credentials.
The Owner has full control of the account, including billing and removing other people.
Admin manages the account day to day, including campaigns and the team.
C-suite is for senior visibility across the account without giving the person day-to-day operational control.
A Campaign Manager creates and runs campaigns.
The Finance role is focused on invoices, payments, payouts and budgets rather than campaign management.
The Legal role is focused on agreements, licences and usage terms.
Member provides general access for someone involved in the work without assigning them a specific functional role.
Viewer is read-only access for stakeholders who need to see what is happening but should not be able to change anything.
Yes. Team members can be given a maximum number of campaigns.
It can prevent one person from quietly becoming responsible for too many campaigns and make workload pressure visible earlier.
Yes. You can change a person's role as their responsibilities change.
Yes. Removing a team member ends their access without requiring you to change everyone else's credentials.
They remain pending and do not have access.
Yes. You can resend an unanswered invitation.
No. Team controls access within one brand account. Workspaces provides separation between multiple client brands, which is particularly useful for agencies.
Yes. An agency can use Workspaces to separate client brands and Team to control the people working within each brand account.
No. Team controls who has access and what they can do. Approval Chain controls who needs to approve work before it proceeds.
That depends on the approval structure configured through Approval Chain.
The Campaign Manager role itself is about running campaigns.
The Finance role is designed for financial work rather than campaign management.
Because you lose individual accountability and cannot control access properly. You also have to rotate the password for everyone whenever one person leaves.
Yes. Publishers can give editorial, commercial, finance and leadership team members access according to their roles.
Yes. Team works within a brand account. For agencies managing multiple client brands, Workspaces provides the additional separation between clients.
Open an account in a few minutes. You pay nothing to use it; a small fee applies only when money moves through Klairova.
Create your free account