How do guest roles work?

A guest is attached to one site, not to your team.

They sign in, they see that site, and there’s no trace of anything else you run. No site list with grayed-out rows, no team page, no billing, no hint of the client next door. Which is what you want if you’re an agency.

There are two:

• Guest viewer - reads the dashboard for that site.
• Guest editor - reads it and can change that site’s settings: goals, funnels, shields, path cleaning.

Neither can touch members, billing, other sites, or the team itself.

Invite one from the site’s own sharing settings rather than the team members screen, since a guest belongs to a site. Same 48-hour expiry as any other invitation, same revoke button.

The design detail worth knowing: guests sit outside the role ranking. The five team roles are ordered - owner above admin above editor and so on - and guests are not on that ladder at all. So a permission check for “at least an editor” can never accidentally admit a guest editor from some unrelated site. It’s a small thing that stops a whole category of quiet access bug.

Guests are unlimited, like team members. There’s no seat cost to giving every client their own login.

When you don’t need a guest at all: if somebody only ever looks and never signs in, a shared link is less work for both of you. Tokenized URL, optional password, optionally pinned to a segment the viewer can’t remove, revocable in one click. That’s usually the right answer for a monthly client report.

To move a whole site to another team - an agency handing a client their own account - there’s a site transfer workflow that carries the analytics with it rather than orphaning them.