Team Plan Permissions Structure

Overview

This analysis looks at how Team and Agency plan customers structure user permissions across their organizations. As Buffer explores a collaboration product with draft-only access, understanding the current distribution of permission setups helps us size the opportunity and see which customers are already running certain workflows.

What We Found

There are about 20,300 active Team and Agency plan orgs. About 7% of them have no team members at all. Of those that do have team members, the median number is 3 and the mean is 4.1.

The most common setup is orgs where team members hold admin and manager roles with no contributors, covering about 63% of orgs. About 28% already have at least one profile contributor.

Methodology

We used the dbt_buffer.publish_permissions table, which records per-user permission grants within each organization. Each row represents a permission record with the following key fields:

user_id – the user holding the permission
profile_id – the channel the permission applies to (null for org-level permissions)
organization_id – the organization
role_type – "organization" for org-wide roles, "profile" for channel-specific roles
role – for org-level: "admin" or "member"; for profile-level: "manager" (full posting access) or "contributor" (draft/approval-required)
is_deleted – whether the permission has been revoked

We filtered to active Team and Agency plan organizations using dbt_buffer.core_organization_billing_records, excluded deleted permission records, and excluded the account owner (identified by billing_contact_id) from all team member counts. This way the analysis reflects invited team members only, not the owner’s own permissions.

We also left joined the permissions data back to the org list so that orgs with no invited members still appear in the results with zero counts.

We count users per org across the four distinct role combinations: organization/admin, organization/member, profile/manager, and profile/contributor. A single user can appear in more than one count if they hold multiple roles.

Data Collection

Code

# Query: org-level summary -- number of team members and role breakdown per org
# Excludes the billing contact (account owner) from team member counts
# Left joins so orgs with zero team members are still included
org_summary_sql <- "
with team_orgs as (
  select distinct
    organization_id
    , billing_contact_id
  from dbt_buffer.core_organization_billing_records
  where plan in ('Team', 'Agency')
    and state = 'paid'
    and not _fivetran_deleted
)

, active_permissions as (
  select
    t.organization_id
    , p.user_id
    , p.profile_id
    , p.role_type
    , p.role
  from team_orgs t
  left join dbt_buffer.publish_permissions p
    on p.organization_id = t.organization_id
    -- exclude the account owner
    and p.user_id != t.billing_contact_id
    and p.is_deleted = false
)

-- count(distinct ...) naturally returns 0 when all user_ids are null (no permissions),
-- so orgs with no team members get zero counts without needing coalesce or filtering
select
  t.organization_id
  , count(distinct p.user_id) as total_members
  , count(distinct case when p.role_type = 'organization' and p.role = 'admin' then p.user_id end) as org_admin_count
  , count(distinct case when p.role_type = 'organization' and p.role = 'member' then p.user_id end) as org_member_count
  , count(distinct case when p.role_type = 'profile' and p.role = 'manager' then p.user_id end) as profile_manager_count
  , count(distinct case when p.role_type = 'profile' and p.role = 'contributor' then p.user_id end) as profile_contributor_count
from team_orgs t
left join active_permissions p
  on t.organization_id = p.organization_id
group by 1
"

org_summary_data <- bq_query(sql = org_summary_sql)
saveRDS(org_summary_data, 'org_summary_data.rds')

Distribution of Team Sizes

The plot below shows the distribution of team sizes across Team and Agency plan customers.

Most Team and Agency orgs are small. About 7% have no team members at all, meaning the account owner has not yet invited anyone. More than 80% of Team and Agency plan customers have 5 or fewer team members, and the median is 3. A small number of larger teams pull the average up to 4.1.

Org-Level Permission Profiles

We classify each org by which of the four role types are present among its team members.

The most common setup is org admin + profile manager with no contributors (37%), meaning team members have both org-wide admin access and channel-level manager roles but nobody requires approval. The next two groups add org member roles into the mix: 26% have org admin + org member + profile manager without contributors, and 24% have that same combination with contributors present. About 4% have org admin + profile manager + contributor without any org member roles. Together, about 28% of orgs have at least one contributor.

A small tail of orgs (about 1.5%) have only org admin roles with no profile-level roles assigned at all, and the remaining combinations are negligible.

How Many Orgs Have Contributors Today?

One of the key questions we want to answer is how many customers already have at least one contributor, meaning they are already using the approval-required workflow.

About 5,700 orgs, roughly 28% of all Team and Agency plan orgs, have at least one contributor today. Among those orgs, the median is 1 contributor and the mean is 2.8, so most orgs using the contributor role are using it lightly. A small number of larger orgs are pulling the average up.