Question 1

How does an agency manage dozens of client websites from one account?

Accepted Answer

The Amaris Agency Control Center (/seo-autopilot/company) gives agencies unified oversight across all client accounts. From a single parent login, account managers can switch between isolated client workspaces, assign dedicated account leads, define different autonomy levels per client, and review universal approval queues without logging into multiple credentials.

Question 2

How does the Universal Approval Queue work across all client sites?

Accepted Answer

The Universal Approval Queue aggregates pending optimizations across your entire client roster into a single, prioritized review inbox. Agency editors can filter by client, risk tier, or change category (e.g. Schema, Metadata, Redirects), preview staging links, and batch-approve or request revisions before changes hit client production environments.

Question 3

Can agencies white-label reports, deliverables, and client portals?

Accepted Answer

Yes. Agency and Enterprise subscriptions include 100% white-label capability. You can upload your corporate agency logo, set custom primary accent colors, connect a custom domain (e.g. clients.youragency.com), and export presentation-ready executive PDF audit decks completely free of Amaris branding.

Question 4

What are the 5 RBAC roles and what access privileges do they have?

Accepted Answer

Amaris enforces 5 granular Role-Based Access Control levels:

1. Owner: Complete organization authority, billing management, subscription upgrades, and master API key generation.
2. Admin: Can add/remove team members, connect new client domains, configure autonomy levels, and manage webhooks.
3. Editor: Can create Brand Studio kits, initiate crawls, and approve non-destructive optimization patches.
4. Employee: Can view assigned project workspaces, execute operational tasks, and view analytics.
5. Client Viewer: Strictly read-only access restricted to their single client workspace for reviewing approvals, invoices, and reports.

Question 5

How does Amaris ensure agency clients never see other clients' data?

Accepted Answer

Every database query, API route, and caching key is cryptographically bound to an explicit organization and client workspace ID validated at the session choke point. Client Viewers only possess JWT tokens scoped to their client ID, making cross-tenant data leakage mathematically impossible.

Question 6

How do digital marketing agencies manage multiple client accounts from a single unified dashboard?

Accepted Answer

Agency management consoles use multi-tenant workspace switching:

• Unified Master Console: Agency team members log into one master dashboard and switch between 50+ client brand workspaces with one click.
• Portfolio Analytics: Roll-up reporting displays aggregate metrics (total crawl health, active campaigns, monthly credit consumption) across all client accounts in a single executive view.
• Asset Isolation: Ensures data, API tokens, and credentials from Client A are never visible to Client B.

Question 7

What is a multi-tenant workspace architecture and how are client assets separated?

Accepted Answer

Multi-tenant architecture partitions data within a shared database infrastructure:

• Tenant Identifier: Every table record includes an `organization_id` column.
• Row-Level Security (RLS): Database rules enforce that queries automatically filter by the active workspace tenant ID.
• Logical Separation: Delivers 90% lower infrastructure hosting costs compared to running 100 separate isolated database servers.

Question 8

How can agency account managers switch between client accounts without logging out?

Accepted Answer

Fast workspace switching uses session context swapping:

• Workspace Dropdown: A global header dropdown lists all client brands the user has permission to view.
• Context Token: Selecting a client updates an active `current_workspace_id` cookie or JWT claim.
• Instant Refresh: The UI immediately re-renders with the selected client's branding, campaigns, and metrics without re-authenticating credentials.

Question 9

What aggregate reporting views help agencies track total performance across all clients?

Accepted Answer

Portfolio overview dashboards surface cross-client intelligence:

• Executive KPI Rollup: Aggregate organic traffic growth, average Core Web Vitals score, and total ranking keywords across all managed domains.
• Exception Alerts: Instant alerts highlighting accounts needing immediate attention (e.g. 'Client X has 3 broken 404 links' or 'Client Y has 5 pending approvals').
• Resource Allocation: Visual charts showing which clients consume the most team hours and monthly production credits.

Question 10

How do agencies allocate monthly usage credits, budgets, and quotas among different clients?

Accepted Answer

Agency plans provide flexible quota pooling and sub-allocation:

• Master Credit Pool: The agency purchases a shared master pool of production credits (e.g. 250,000 credits/month).
• Sub-Account Quotas: Allocate custom caps per client (e.g. 10,000 credits for Client A; 50,000 for Enterprise Client B).
• Overdraft Controls: Configure hard caps to prevent a single client from draining the agency's shared monthly credit balance.

Question 11

What client onboarding workflows reduce initial setup friction for new agency retainers?

Accepted Answer

Streamline client onboarding with self-service intake links:

• Client Invite Link: Send a secure link inviting the client's marketing manager to enter their CMS API credentials, Google Search Console permissions, and brand voice guidelines.
• Automated Baseline Crawl: The platform automatically executes an initial technical audit and sitemap crawl, generating a baseline report ready for the kickoff presentation.
• Time-to-Value: Reduces onboarding from 2 weeks of manual emails down to under 30 minutes.

Question 12

How do agencies handle client offboarding while securely transferring ownership of digital assets?

Accepted Answer

Clean offboarding protects agency IP while ensuring smooth handoffs:

• Workspace Ownership Transfer: Promote the client's internal marketing director to 'Primary Owner' and remove agency staff access.
• Credential Revocation: Invalidate shared agency API keys and prompt the client to re-enter their own independent billing details.
• Export Archives: Provide a complete downloadable export of all historical audit reports, SEO diffs, and generated brand manuals.

Question 13

What is the difference between an agency master account and individual client workspaces?

Accepted Answer

The distinction governs billing and visibility:

• Agency Master Account: Controls subscription billing, overall credit pooling, agency team roles, and white-label branding configurations.
• Individual Client Workspaces: Scoped sandbox containing only that specific client's website connections, campaigns, and approval queues. Client viewers can log into their specific workspace without seeing other agency clients.

Question 14

What is an approval queue and how does it prevent unreviewed changes from going live?

Accepted Answer

An approval queue is an operational staging checkpoint in autonomous workflows:

• Staged Mutations: When an automated engine or junior editor drafts changes (code diffs, title tags, ad copy), the changes are held in a `pending_review` state.
• Visual Previews: Stakeholders review proposed changes alongside side-by-side visual comparisons before deployment.
• Quality Gate: Changes cannot be pushed to production without an authorized reviewer clicking 'Approve'.

Question 15

How do agencies allow clients to preview, review, and approve proposed copy and design changes?

Accepted Answer

Provide client stakeholders with dedicated approval portals:

• Contextual Diffs: Show original text alongside proposed copy in green/red diff blocks.
• Staging Links: Generate password-protected or tokenized ephemeral preview URLs where clients can interact with the live layout.
• One-Click Approval: Clients approve or request edits directly from the portal without exchanging endless email attachments.

Question 16

Can clients leave contextual comments and change requests directly on staging previews?

Accepted Answer

Yes. Modern review platforms feature inline visual commenting (similar to Figma or Google Docs):

• Pin-Point Comments: Clients click on specific headings or images on the staging preview to pin feedback.
• Resolution Tracking: Comment threads track discussion history and automatically resolve when the copy is updated.

Question 17

What happens when an agency manager approves changes in bulk across multiple accounts?

Accepted Answer

Bulk approval executes atomic deployment batches:

• Multi-Select Actions: Select 50 approved metadata updates across multiple client accounts and click 'Batch Deploy'.
• Queue Sequencing: The orchestrator processes updates across CMS APIs with rate-limiting and verifies HTTP 200 responses.
• Audit Logging: Records the manager's user ID and timestamp against all 50 deployed records.

Question 18

How do automated audit logs track who approved each deployment and at what timestamp?

Accepted Answer

Audit logging creates an immutable record of change management:

• Captured Metadata: Logs `event_id`, `actor_email`, `role`, `action`, `resource_id`, `timestamp_utc`, and `ip_address`.
• Compliance & Non-Repudiation: Proves to enterprise clients and SOC 2 auditors exactly who authorized every code push or content modification.

Question 19

What notification channels alert clients when an item is waiting for their review?

Accepted Answer

Multi-channel alerts keep approval queues moving:

• Email Alerts: Instant notification emails with direct one-click review links.
• Slack & Microsoft Teams Integrations: Interactive Slack messages with 'Approve' and 'Reject' buttons.
• Daily Digest: A morning email summarizing all pending approvals awaiting review to avoid notification fatigue.

Question 20

How do staging environments simulate live production CMS databases without risking downtime?

Accepted Answer

Staging environments maintain isolated data copies:

• Read-Only Production Sync: Clone production CMS data into a separate staging database.
• Ephemeral Branches: Automated changes are committed to staging branches, allowing full end-to-end testing without touching live production tables.

Question 21

What are the best practices for setting up client review deadlines and auto-approval rules?

Accepted Answer

Establish clear Service Level Agreements (SLAs) in client retainer contracts:

• Review Windows: Define standard review windows (e.g. 5 business days).
• Auto-Approval Policy: If a client does not request modifications within the agreed window, changes can be automatically deployed according to contract terms to prevent project stagnation.
• Reminders: Send automated reminder notifications 48 hours and 24 hours prior to deadline expiration.

Question 22

What does white-labeling mean in B2B software and digital marketing platforms?

Accepted Answer

White-labeling allows agencies to rebrand commercial software as their own proprietary tool:

• Custom Branding: Replace the vendor's logo, color palette, and company name with the agency's brand identity.
• Custom Domain: Serve the platform on the agency's domain (e.g. `portal.youragency.com`).
• Commercial Value: Agencies position themselves as tech-enabled firms with proprietary software, justifying higher monthly retainer fees.

Question 23

How do agencies set up custom branded client portals on their own custom domain?

Accepted Answer

Configuring a white-label custom domain follows three technical steps:

1. Add Custom Domain: In the agency dashboard, enter your desired subdomain (e.g. `clients.youragency.com`).
2. CNAME DNS Record: In your DNS provider (Cloudflare, GoDaddy, Route53), create a `CNAME` record pointing your subdomain to the platform's edge server.
3. Automatic SSL Provisioning: The platform automatically provisions and renews a free Let's Encrypt SSL certificate via Cloudflare for SSL encryption.

Question 24

How do white-label PDF reports help agencies prove monthly ROI to non-technical stakeholders?

Accepted Answer

Executive-ready PDF reports translate technical data into business outcomes:

• Agency Header & Logo: Cleanly styled with the agency's colors, logo, and contact info.
• Executive Summary: Highlights organic traffic growth, new keyword rankings, and technical improvements.
• Automated Scheduling: Automatically generated and emailed to client executives on the 1st of every month without manual assembly.

Question 25

Can agencies customize logos, primary brand colors, and email notification headers?

Accepted Answer

Yes. Comprehensive white-labeling customizes all client touchpoints:

• Visual Styling: Upload light and dark mode logos, favicon, and primary hex accent color.
• Email Notifications: System emails (password resets, approval requests, monthly reports) are dispatched from the agency's custom SMTP domain (e.g. `reports@youragency.com`) with custom branded email headers.

Question 26

Why do enterprise clients insist on vendor-neutral or agency-branded login screens?

Accepted Answer

Enterprise clients demand cohesive brand experiences:

• Professionalism: Exposing third-party SaaS vendor branding confuses corporate stakeholders and erodes the perception of the agency's proprietary expertise.
• Security Assurance: Branded portals integrated with client Single Sign-On (SSO) satisfy corporate IT procurement standards.

Question 27

How do automated white-label monthly performance reports save 10+ hours of manual labor per client?

Accepted Answer

Eliminate manual screenshotting and spreadsheet aggregation:

• Automated Data Pulls: The platform automatically pulls live metrics from Google Search Console, Lighthouse, and rank trackers.
• Turnkey Compilation: Generates polished 10-page PDF reports with narrative explanations in seconds, saving hundreds of hours across large client portfolios.

Question 28

What key performance indicators (KPIs) should be featured on an executive marketing dashboard?

Accepted Answer

Executive dashboards prioritize high-level business impact over obscure technical jargon:

1. Qualified Organic Pipeline & Revenue Growth: Direct economic return on marketing investment.
2. Page 1 Keyword Rankings: Number of high-intent commercial keywords reaching top Google positions.
3. Core Web Vitals & Technical Health Score: Overall percentage of passing pages.
4. Organic Traffic Velocity: Month-over-month growth compared to previous year benchmarks.

Question 29

How do you securely share read-only live dashboard links with external client stakeholders?

Accepted Answer

Provide clients with secure, frictionless access:

• Tokenized Magic Links: Share read-only dashboard URLs authenticated via secure, expiring cryptographically signed tokens.
• Restrictive Client Viewer Roles: Client logins are scoped strictly to view-only access, preventing clients from modifying configurations or viewing internal agency notes.

Question 30

What is Role-Based Access Control (RBAC) and why is it crucial for agency teams?

Accepted Answer

Role-Based Access Control (RBAC) restricts system access based on an employee's organizational role:

• Principle of Separation of Duties: Junior copywriters should not have permissions to modify payment credit cards or delete production databases.
• Pre-Configured Role Bundles: Assign users predefined roles (Owner, Admin, Editor, Viewer) to enforce consistent security policies without configuring individual user permissions.
• Reduced Insider Threat: Limits the operational blast radius if a team member's personal login credential is leaked.

Question 31

What are standard user roles in multi-tenant SaaS: Owner, Admin, Editor, Member, and Viewer?

Accepted Answer

Standard SaaS role hierarchies and their typical permissions:

• Owner: Full legal and financial authority. Manages billing, workspace deletion, ownership transfers, and SSO.
• Admin: Can invite/remove members, generate API keys, configure integrations, and manage all projects.
• Editor: Can create, update, and submit changes to approval queues; cannot manage billing or invite users.
• Member: Can view projects and execute read-only workflows.
• Viewer (Client): Strict read-only access to view reports and dashboards without editing capabilities.

Question 32

How do you restrict junior employees or freelancers from accessing billing or sensitive client data?

Accepted Answer

Enforce granular role boundaries:

• Mask Financial Data: Ensure only Owner and Admin roles can view invoices, credit card details, and monthly subscription tiers.
• Workspace-Level Scoping: Assign freelancers to specific client workspaces rather than granting agency-wide access.
• Approval Gates: Require changes authored by junior staff or contractors to pass through an agency manager's approval queue before going live.

Question 33

Can clients be granted restricted 'Approver Only' access to their brand workspace?

Accepted Answer

Yes. An 'Approver Only' role gives clients a streamlined review experience:

• Simplified UI: Hides complex developer settings and shows only the pending approval feed.
• Action Permissions: Clients can preview proposed diffs, leave inline feedback comments, and click 'Approve' or 'Request Edits'.
• Safeguard: Prevents non-technical client stakeholders from accidentally breaking tracking tags or modifying API integrations.

Question 34

What is the difference between Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC)?

Accepted Answer

Comparing access control paradigms:

• RBAC (Role-Based): Permissions are static based on assigned role (e.g. 'All Editors can edit posts'). Simpler to configure and audit.
• ABAC (Attribute-Based): Evaluates dynamic attributes in real time (e.g. user department, IP location, time of day, classification of resource). Used by high-security enterprises requiring context-aware access (e.g. 'Allow edit only if user is on corporate VPN during business hours').

Question 35

How does Single Sign-On (SSO) with SAML and Okta enforce centralized user provisioning?

Accepted Answer

Enterprise SSO streamlines identity management across SaaS tools:

• Central Identity Provider (IdP): Employees authenticate through Okta, Azure AD, or Google Workspace.
• Automated Provisioning (SCIM): When HR hires a new employee in Okta, the account is automatically created in all SaaS tools with the correct role.
• Instant Deprovisioning: When an employee leaves, revoking their Okta access instantly cuts access to all agency platforms and client data.

Knowledge Base & FAQs

Agency Control Center & Workspaces4

How does an agency manage dozens of client websites from one account?

How do digital marketing agencies manage multiple client accounts from a single unified dashboard?

What is a multi-tenant workspace architecture and how are client assets separated?

How can agency account managers switch between client accounts without logging out?

Universal Approval Queue & Staging1

How does the Universal Approval Queue work across all client sites?

White-Label Reports & Client Portals1

Can agencies white-label reports, deliverables, and client portals?

Role-Based Access Control (RBAC)1

What are the 5 RBAC roles and what access privileges do they have?

Client Delegation & Tenant Isolation1

How does Amaris ensure agency clients never see other clients' data?