Agencies
Put each client in a workspace. Invite an editor onto that workspace only. The owner keeps billing.
Access
Presets cover member, admin, billing, viewer, analyst and publisher. A custom role can turn individual permissions off. An API key cannot exceed the person’s access.
Accounts
A network account belongs to the organization. Attach it to several client workspaces without connecting it again.