Team Plan Permissions Structure

Overview

This analysis looks at how Team and Agency plan customers structure user permissions across their organizations. As we explore a collaboration solution with potentially draft-only access, understanding the current distribution of permission setups helps us size the opportunity and see which customers are already running certain workflows.

What We Found

There are about 20,300 active Team and Agency plan customers in our data sample. About 9% of them have no profile-level permissions assigned to team members at all. Among those that do have team members with profile permissions, the median number of team members is 3 and the mean is 3.9.

The most common setup is managers only, covering 63% of customers. About 28% of customers have both managers and contributors, meaning they are already running an approval workflow.

Methodology

We used the dbt_buffer.publish_permissions table, which records per-user permission grants within each organization. Each row represents a permission record with the following key fields:

user_id – the user holding the permission
profile_id – the channel the permission applies to (null for org-level permissions)
organization_id – the organization
role_type – we filter to "profile" only, which represents channel-specific permissions
role – "manager" (full posting access) or "contributor" (draft/approval-required)
is_deleted – whether the permission has been revoked

We filtered to active Team and Agency plan organizations using dbt_buffer.core_organization_billing_records, excluded deleted permission records, and excluded the account owner (identified by billing_contact_id) from all team member counts. This way the analysis reflects invited team members only, not the owner’s own permissions.

We also left joined the permissions data back to the org list so that orgs with no invited members still appear in the results with zero counts.

We focus exclusively on profile-level permissions (role_type = 'profile'), which represent the actual channel access a user has. We count users per org with profile/manager roles (full posting access) and profile/contributor roles (draft/approval-required) separately. Organization-level roles (admin, member) are excluded from this analysis.

Data Collection

Code

# Query: org-level summary -- number of team members and role breakdown per org
# Excludes the billing contact (account owner) from team member counts
# Left joins so orgs with zero team members are still included
org_summary_sql <- "
with team_orgs as (
  select distinct
    organization_id
    , billing_contact_id
  from dbt_buffer.core_organization_billing_records
  where plan in ('Team', 'Agency')
    and state = 'paid'
    and not _fivetran_deleted
)

, active_permissions as (
  select
    t.organization_id
    , p.user_id
    , p.profile_id
    , p.role
  from team_orgs t
  left join dbt_buffer.publish_permissions p
    on p.organization_id = t.organization_id
    -- profile-level permissions only
    and p.role_type = 'profile'
    -- exclude the account owner
    and p.user_id != t.billing_contact_id
    and p.is_deleted = false
)

-- count(distinct ...) naturally returns 0 when all user_ids are null (no permissions),
-- so orgs with no team members get zero counts without needing coalesce or filtering
select
  t.organization_id
  , count(distinct p.user_id) as total_members
  , count(distinct case when p.role = 'manager' then p.user_id end) as profile_manager_count
  , count(distinct case when p.role = 'contributor' then p.user_id end) as profile_contributor_count
from team_orgs t
left join active_permissions p
  on t.organization_id = p.organization_id
group by 1
"

org_summary_data <- bq_query(sql = org_summary_sql)
saveRDS(org_summary_data, 'org_summary_data.rds')

Distribution of Team Sizes

The plot below shows the distribution of team sizes across Team and Agency plan customers.

Most Team and Agency orgs are small. About 9% have no profile-level permissions among team members. Among customers that do, around 85% have 5 or fewer team members with profile permissions, and the median is 3. A small number of larger teams pull the mean up to 3.9.

Org-Level Permission Profiles

We classify each org by which profile-level role types are present among its team members.

The most common profile is managers only – 63% of orgs have team members with profile/manager roles and no contributors, meaning everyone can post freely and nobody requires approval. About 28% of orgs have both managers and contributors present, meaning they are already running some form of the approval workflow. About 9% of orgs have no profile-level permissions at all among team members, which likely means those users have only org-level roles. A small number of orgs (under 0.1%) have contributors with no managers.

How Many Orgs Have Contributors Today?

One of the key questions we want to answer is how many customers already have at least one contributor, meaning they are already using the approval-required workflow.

About 5,700 orgs, roughly 28% of all Team and Agency plan orgs, have at least one contributor today. Among those orgs, the median is 1 contributor and the mean is 2.8, so most orgs using the contributor role are using it lightly. A small number of larger orgs are pulling the average up.

Caveats

Only profile-level permissions are included. Organization-level roles (admin, member) are excluded.
Permission records with is_deleted = true are excluded.
The account owner (billing_contact_id) is excluded from all team member counts.
Orgs with no profile-level permissions among team members appear in the results with zero counts. This includes orgs where the account owner has not invited anyone, as well as orgs where invitees have only org-level roles assigned.
The analysis covers currently active Team and Agency plan orgs in core_organization_billing_records. Orgs that churned or downgraded are not included.