Zodiac Tech CRM Docs

Users & agency team

Manage platform users, reset passwords, suspend accounts, and run the agency team logins.

super-admin Medium ⏱ 10 min Updated 2026-10-05

Users & agency team

There are two kinds of staff accounts in the Super Admin panel:

  • Platform users at /super-admin/users — every client user (and any Super Admin), searchable across all businesses.
  • Agency team at /super-admin/meta-ads/agency-team — Zodiac Tech's Meta-ops staff who work in the /agency panel.

Who this is for

Super Admins. Agency team management is Super-Admin-only by design.

  • Difficulty: Medium
  • Time: 10 min
  • Prerequisites: Super Admin access.

There is no "create user" button on the Users page /super-admin/users is a view-and-manage list (edit, reset password, suspend, impersonate). Client users are created elsewhere:

  • the client's first admin — when you create a Business;
  • additional client users — by the client's admin in the tenant panel (/admin team page);
  • agency staff — on the Agency Team page below.

Part A — Platform users (/super-admin/users)

Step 1 — Find a user

The table lists name, email, business, whether they are a Super Admin, suspension status and created date. Use the tenant and role filters to narrow the list.

Step 2 — Reset a password

Click Reset password on the row. The user receives a Laravel password-reset email (Password::broker()->sendResetLink()). You never see or set their password from this screen.

Step 3 — Suspend or unsuspend

Suspend sets suspended_at and invalidates the user's sessions — they can no longer log in. You cannot suspend yourself. Unsuspend reverses it.

Step 4 — Impersonate a client user

Impersonate is available only for tenant users (not Super Admins). You are logged in as that user and taken to /admin; the impersonation bar with Stop appears on every page. The action is audited.

Step 5 — Edit profile details

Edit opens the standard user form (name, email, roles, business). Role changes take effect on the user's next request.

Part B — The agency team (/super-admin/meta-ads/agency-team)

The Agency Team page holds the logins for staff who run Meta operations in the separate /agency panel. These users have no business attached — their only door is /agency/login.

Step 6 — Add a team member

  1. Open Meta Ads → Agency Team → New team member.
  2. Fill Login: name, email. On create, a 14-character password is generated and shown once — copy it and send it to the staff member securely. On edit, leave the password blank to keep the current one.
  3. Under What they can do, tick at least one role (see the table below). Some people hold more than one.
  4. Save, then send the staff member their login URL (/agency/login), email and the one-time password.

Step 7 — Assign the right role

Role What they can do
Account Manager Client relationship: view Meta data, run setup, manage client assignments, connect accounts, manage support, view performance
Ads Specialist View, setup, connect, create / edit / pause campaigns, view performance
Creative Specialist View Meta data, manage creatives
QA Reviewer (can launch) View Meta data + launch campaigns — the only role that can
Support Agent View, connect, handle support

Launch access is guarded Only the QA Reviewer role can launch a campaign (meta.campaign.launch). The launch toggle refuses to remove that role if it is the person's only role — a user can never be left able to log in but unable to do anything. Every grant/removal is audited as agency_staff.launch_enabled / agency_staff.launch_disabled.

Step 8 — Grant or remove launch access quickly

The team table has a launch access flag per row. Use the toggle launch action to add or remove the qa_reviewer role without opening the full form. The same safeguards apply.

Step 9 — Suspend instead of delete

Team members cannot be deleted from this screen — suspend them instead. Suspension blocks login and keeps their history intact; unsuspend restores access.

Expected result

A client user can be found and managed from /super-admin/users; an agency staff member exists with the right roles, can log in at /agency/login, and only QA Reviewers show launch access.

Common mistakes

  • Looking for "New user" under Users. Use the correct creation path above.
  • Generating a password on create and not copying it. It is shown once; if it is lost, edit the member and set a new one.
  • Removing QA Reviewer from the only QA person. The toggle refuses; assign another role first if the person must lose launch access.
  • Expecting agency staff in the Users list. Agency users are tenant-less; they live on the Agency Team page only.
  • Suspend vs subscription. User suspension is an account action; subscription handling lives in Payment failures & restrictions.

Troubleshooting

Symptom What to check
Reset email never arrives SMTP health — see Email & SMTP
Agency login rejected Staff must use /agency/login, not the client or Super Admin login
Suspend button does nothing on your own account Self-suspension is blocked by design
A user can't see a new role's menu Role changes apply on next request/login; ask them to log out and back in
Impersonate missing for a user Only tenant users can be impersonated

Technical details

  • App\Filament\SuperAdmin\Resources\UserResource — pages: index + edit only; actions reset_password, suspend, unsuspend, impersonate_user; audited.
  • App\Filament\SuperAdmin\Resources\AgencyStaffResource — slug meta-ads/agency-team, group "Meta Ads"; create generates Str::password(14); role options from ROLE_LABELS; delete disabled.
  • Agency roles: database/seeders/AgencyRolesSeeder.php — 13 meta.* permissions across account_manager, ads_specialist, creative_specialist, qa_reviewer, support_agent; only qa_reviewer holds meta.campaign.launch.
  • Agency panel: /agency (separate Filament panel); tenant roles: admin, manager, member (Spatie).
  • Impersonation bar: resources/views/filament/impersonation-bar.blade.php; stop route impersonation.stop.

Was this page helpful?