Security

Progrid Google Ads Integration uses a three-tier security model based on standard Progrid groups. Access ranges from read-only visibility for salespeople to full configuration control for system administrators.

User groups

Salesperson

The Salesperson group (sales_team.group_sale_salesman) provides read-only access to conversion data and reports. This is the base access level for anyone who needs to see how their leads are being tracked in Google Ads.

Permissions:

Model

Create

Read

Update

Delete

Conversion Queue (google_ads.conversion_queue)

No

Yes

No

No

Campaign Reports (google_ads.campaign_report)

No

Yes

No

No

Ad Group Reports (google_ads.adgroup_report)

No

Yes

No

No

Keyword Reports (google_ads.keyword_report)

No

Yes

No

No

Audience Lists (google_ads.audience_list)

No

Yes

No

No

Lead Form Imports (google_ads.lead_form_import)

No

Yes

No

No

Sales Manager

The Sales Manager group (sales_team.group_sale_manager) extends salesperson access with full CRUD permissions on operational models. Managers can configure CRM stage sync, manage audience lists, acknowledge health alerts, and create value rules.

Permissions:

Model

Create

Read

Update

Delete

Conversion Queue (google_ads.conversion_queue)

Yes

Yes

Yes

Yes

Health Alerts (google_ads.health_alert)

Yes

Yes

Yes

Yes

Audience Lists (google_ads.audience_list)

Yes

Yes

Yes

Yes

Audience Members (google_ads.audience_member)

Yes

Yes

Yes

Yes

Value Rules (google_ads.value_rule)

Yes

Yes

Yes

Yes

Campaign Reports (google_ads.campaign_report)

Yes

Yes

Yes

Yes

Ad Group Reports (google_ads.adgroup_report)

Yes

Yes

Yes

Yes

Keyword Reports (google_ads.keyword_report)

Yes

Yes

Yes

Yes

Lead Form Imports (google_ads.lead_form_import)

Yes

Yes

Yes

Yes

Import Segments Wizard

Yes

Yes

Yes

Yes

System Administrator

The System Administrator group (base.group_system) is the only group with access to the Google Ads configuration record, which contains OAuth2 credentials and API settings.

Additional permissions:

Model

Create

Read

Update

Delete

Configuration (google_ads.config)

Yes

Yes

Yes

Yes

Important

API credentials (developer token, client ID, client secret, refresh token) are only visible to system administrators. Other users cannot see or modify these values.

Record rules

Conversion queue company isolation

Conversion queue entries are filtered by company ownership. Users can only see queue entries for leads belonging to their current company. The rule uses the domain [('lead_id.company_id', 'in', company_ids)] to enforce multi-company isolation.

Health alert visibility

Health alerts are visible to all managers regardless of company. Since alerts relate to the shared Google Ads account configuration, they are not company-filtered.

Assigning groups

To assign Google Ads access to a user:

  1. Navigate to Settings ‣ Users & Companies ‣ Users.

  2. Select the user to configure.

  3. Scroll to the Sales section.

  4. Set the Sales field to User (read-only) or Manager (full access).

  5. Click Save.

Note

The Google Ads module does not define its own security groups. It relies on the standard Sales Team groups (Salesperson and Sales Manager) and the System Administrator group for configuration access.