Guide
Team Product Scope
Combine role permissions with the products the member is allowed to manage.
Two checks, not one
A permitted action still needs the relevant product scope. A product assignment does not by itself grant every operational or financial permission. Test both dimensions when reviewing team access.
Some account-wide settings require broader scope and specific view/manage permissions. For example, GA4 settings require the appropriate settings permission and all-product scope; assignment to one product is not enough.
Review changes
Use supported role/scope updates and member removal. Confirm later sessions and requests honor the new access. Do not share the owner account to bypass a member restriction or place owner tokens into client packages.