Business Managers often collect more administrators than they need. A freelancer receives full access for a short project, a former employee remains on the account, or an agency keeps its permissions after a contract ends. Over time, many people may gain the ability to change billing details, remove users, or alter important assets.Meta's own guidance on Business Manager roles recommends giving each person only the access required for their work. More access can always be added later. For most team members, Employee access to specific ad accounts and tools is sufficient. Admin access should be limited to a small group responsible for settings, users, and billing. Task based permissions allow this to be managed more precisely. For example, a media buyer can receive permission to manage campaigns or view performance without also being able to change payment methods or remove other people from the business. The initial setup is only part of the job. Permissions should be reviewed regularly in the People section of Business Settings. Access should also be removed as soon as someone leaves the company, changes roles, or finishes a project. Waiting for a scheduled quarterly review leaves the account exposed for longer than necessary. Stale access is easy to overlook because it does not create an immediate problem. It becomes serious when an old login is compromised or someone makes an unauthorized change. bm2500 provides a checklist that can help teams run these reviews consistently.