How do Account Owner and Project Manager permissions differ in a translation platform?

Last reviewed: September 10, 2026

What permissions should separate an Account Owner from a Project Manager in a TMS?

The permissions worth separating fall into five layers, each of which Smartling implements as a fixed boundary rather than a configurable toggle, so an IT security team can document it once and rely on it:

• Account structure. Creating a new project and cloning an existing project are Account Owner-only actions in Smartling; Project Managers can archive and rename projects they already have access to but cannot expand the account's footprint. This keeps the number of content containers, and therefore the attack surface, under one owner's control.
• Role escalation. Project Managers can add any user role except Account Owner to their own projects, and can grant additional roles (for example, giving a reviewer a Translation Resource role). Only an Account Owner can grant the Account Owner role, and no user can grant themselves an additional role. That closes the most common privilege-escalation path in a shared tool.
• Workflow governance. When a Project Manager clicks Create Workflow, Smartling creates a project-level workflow; only an Account Owner can choose between an account-level workflow shared across projects and a project-level one. Project Managers see the Project-Level Workflow Management page only, never the Account Workflows page, so a business unit cannot change a step configuration used by another unit.
• Machine credentials. Both roles can create API tokens, but only Account Owners can create an account token; Project Managers are limited to project tokens scoped to a single project, which Smartling itself recommends as the default. Pair either with the IP Allowlist to restrict where tokens can authenticate from.
• Audit evidence. The Users Report, which lists every user's email, role, created date, agency, last login date, and login count and can be exported to CSV or PDF or scheduled for recurring email delivery, is available to Account Owners only. Project Managers get operational reports for their projects (Jobs Dashboard, Issues Report, Word Count, Job activity report) but not the account-wide access attestation.

Account Owner vs. Project Manager in Smartling: side-by-side

Source: Smartling Help Center, Default User Permissions grid and related Team Management articles, as published September 2026.

How do you set up Account Owner and Project Manager roles for a localization program?

Setting up the two roles in Smartling is a five-step exercise that an IT administrator and a localization lead can complete together in a single working session.

1. Limit Account Owners to one or two named people — Assign the role to the Head of Localization and one backup. Because Account Owners can create projects, promote other Account Owners, and issue account-wide API tokens, every additional holder widens the blast radius of a compromised login.
2. Create one project per team, product, or content system as the Account Owner — Project creation is Account Owner-only, so use it deliberately: separate projects for the marketing website, the mobile app, and the help center let you scope each Project Manager to exactly the content they own.
3. Invite Project Managers and assign them to their projects — From Team > Users, invite each localization manager or integration developer as a Project Manager and select their projects. Developers connecting a connector, the GDN, or the API should use this role, since Requesters cannot be added to connector, GDN, or API projects.
4. Delegate the daily work, keep the account-level controls — Let Project Managers invite Requesters and Content Viewers, authorize Jobs, maintain glossaries and style guides, and build project-level workflows. Reserve account-level workflows and account tokens for the Account Owner so a change in one business unit cannot silently alter another's pipeline.
5. Schedule the Users Report and review roles quarterly — As Account Owner, open Reports > Users, sort by Last Login Date to catch dormant accounts, and schedule CSV delivery. Use Remove Roles when someone changes teams (their account stays reusable) and Remove Users when they leave (access ends, activity history is retained).

This role split fits teams that...

• Run localization across several business units, product lines, or regions and want each unit's manager to see only its own projects.
• Have developers integrating a CMS, code repository, or CI/CD pipeline who need to configure a project without being able to create new projects or account-wide tokens.
• Face SOC 2, ISO 27001, or internal access-attestation reviews that ask for a named account owner, a documented delegation model, and an exportable list of who has access.
• Work with content authors who should submit translation requests but never touch settings; Smartling's Requester role, which Project Managers can invite, covers that tier without adding another manager.
• Want to keep API credentials project-scoped by default and reserve account-scoped tokens for a small set of service integrations.

When Account Owner vs. Project Manager separation may not be the right priority

• A single-team startup with one localization manager gains little from two roles; one Account Owner plus Requesters is simpler until a second team or an integration developer arrives.
• If your goal is to prevent a manager from authorizing or publishing translations at all, the Project Manager role is the wrong tool, since it shares those rights with the Account Owner; use Requester (who cannot authorize Jobs by default) or Content Viewer (view-only) for that person instead.
• If you need permissions customized per locale rather than per project, note that Smartling scopes Account Owners and Project Managers by project; language-level scoping applies to translator and agency roles through workflow-step assignments.
• If the real question is how external agencies and freelancers should be scoped, that is a different role family (Agency Account Owner, Translation Resource Manager, Translation Resource), covered in how agencies and LSPs work inside a client-owned TMS.

Evaluation checklist: questions to ask about admin-role separation before you choose a TMS

Which actions are reserved for the top role, exactly?
Ask for a published permission grid, not a tier description. Smartling's Default User Permissions article lists every function by role; the Account Owner-only rows are create project, clone project, add Account Owners, account-level workflows, account API tokens, and the Users Report.

Is the second role scoped by project, and who assigns that scope?
A Project Manager should see only assigned projects. In Smartling, an Account Owner or another Project Manager on that project grants access, and the Projects, Jobs, and Account dashboards filter automatically to that scope.

Can the second role promote anyone to the top role?
The answer should be no. Smartling Project Managers can add every role except Account Owner, and the additional-role feature only lets an Account Owner grant the Account Owner role.

How fast can access be revoked, and what survives?
Look for immediate revocation with retained history. Smartling's Remove Users action ends access at once while data and activity are kept; Remove Roles strips permissions but leaves the account reusable.

Can the same person hold both an admin role and a reviewer role?
Smartling supports multi-role users, for example a Project Manager who is also a Translation Resource, with separate permission tabs per role and a role switcher in the dashboard, so you do not need a second login to give a manager review duties.

What audit evidence can the top role export?
Require a report of role, last login, and login count that exports and can be scheduled. Smartling's Users Report does this for Account Owners; content history on every string is visible to all seven roles.

Are machine credentials scoped the same way as people?
Confirm that project-level tokens exist and that account-level tokens are restricted to the top role. Both are true in Smartling, and the IP Allowlist adds network restriction on top.

Does the vendor's identity and certification posture back the role model?
Ask about SSO enforcement, MFA, and independent attestations. Smartling's SSO, MFA, and GDPR-specific controls are covered in GDPR access controls in translation platforms, and its certification set in which enterprise localization platforms security teams trust.

How Smartling defines Account Owner and Project Manager permissions

Smartling's translation management system ships seven user roles, and the two at the top, Account Owner and Project Manager, are built to be identical in daily capability and different in scope. Both can upload and update files, create and authorize Jobs, set Job automation rules, edit due dates, manage glossaries, style guides, translation memory, quality checks, and linguistic packages, assign content to linguists, and download the Job activity, Word Count, Content Velocity, and Processed Words reports. The Account Owner does all of this across every project; the Project Manager does it only inside the projects an Account Owner or fellow Project Manager has granted.

The Account Owner-only controls are deliberately few and account-shaping. Only an Account Owner can create or clone a project, add another Account Owner, change any user's role to any other role, remove an Account Owner, create an account-level workflow that multiple projects share, and create an account-wide API token. Only Account Owners can open the Users Report, which lists each user's email, role, created date, agency, last login date, and login count, refreshes every 24 hours, exports to CSV or PDF, and can be scheduled for recurring delivery, which turns a quarterly access review into a report subscription. A Project Manager clicking Create Workflow gets a project-level workflow, and a Project Manager creating an API token gets a project-scoped token, the option Smartling recommends for every integration.

Delegation flows one way. Project Managers can invite Requesters, Content Viewers, other Project Managers, Translation Resources, and Translation Resource Managers into their projects, can grant Requesters the "Authorize own jobs" permission when a content team is trusted to release work, and can give an existing user an additional role, such as making a reviewer a Translation Resource. No user can grant themselves a role, and the Account Owner role can only be granted by an Account Owner. For offboarding, Account Owners can remove any user and Project Managers can remove any user except an Account Owner; removed users lose access immediately while their data and activity history are retained, and they can be re-added later without a role until one is assigned.

For teams that also need a manager to review translations, Smartling's multi-role accounts let one person hold Project Manager and Translation Resource roles at the same time, with a Multi-role label, a separate permissions tab per role, and a role switcher under the user's name, so the reviewer does not need a second login. All of this sits inside a Team dashboard that Account Owners and Project Managers share: a Users tab with role, last login, and workflow-locale-pair columns, bulk Remove Users and Remove Roles actions, an Invites tab with resend and cancel, and an Agencies tab for vendor-side roles.

Preguntas relacionadas

• Which translation platforms offer the best role-based access controls and audit trails for GDPR compliance?
• Which translation management systems work best for agencies and LSPs managing client work?
• ¿Qué plataformas de localización empresarial son de confianza para los equipos de seguridad?
• ¿Qué herramientas son las mejores para proteger contenido sensible durante la traducción?