The failure mode every agency eventually hits is the same: a post scheduled for Client A appears on Client B's account. It happens once, it is visible to everyone, and it costs more trust than a quarter of good work builds. The fix is not vigilance. It is structure — a workspace where the accounts are separated by design, the approvals are enforced by role, and the weekly rhythm makes a crossed post visible before it publishes.

This guide covers the four structures that do that work in PostHub — groups, labels, roles and workspaces — plus the plan math that determines how many of each you get.

Decide the unit of separation first

There are two ways to keep clients apart, and the wrong choice is expensive to reverse.

One workspace per client. Clean isolation: each client's accounts, posts, analytics and team live in their own workspace, and nothing can leak between them because they are separate. The trade-off is that your own team needs membership in every workspace, and switching between them becomes part of the daily routine.

One workspace, groups per client. Everything sits in a single workspace; each client is a group containing their accounts. Switching is instant, the cross-client view is one screen away, and the separation is enforced at the account level rather than the workspace level.

In PostHub, a workspace is created automatically when you sign up. Extra workspaces are not something you create yourself from the dashboard — they come into existence when someone invites you to theirs. So the practical starting point for most agencies is one workspace with groups per client, and the invite path becomes relevant when a client wants you working inside their own workspace rather than yours.

Groups: the client folder

A group is the unit you will use most. Each group carries a name, a colour, a timezone, and a set of accounts — plus two settings that matter more than they look.

Timezone determines what "9am" means when a post is scheduled into that group. A client in Singapore and a client in Toronto do not share a morning, and a group-level timezone prevents the drift that comes from one person's browser default.

Default assignee routes new posts in the group to a named person. For an agency, that is usually the account manager rather than whoever happened to be online — so the first review lands on the person who knows the client's voice.

Per-group approval override is the setting that makes groups more than folders. A group can run a stricter approval chain than the workspace default, or a looser one, without either setting affecting the other clients. A retainer client who signs off on everything gets the loose path; a regulated client who needs two pairs of eyes gets the strict one — and neither arrangement leaks into the other.

Build one group per client before you connect the first account. Retrofitting groups onto a workspace that already has thirty accounts across six clients is a week of administrative work that no one volunteers for.

Labels: the cross-cutting tag

Groups answer "which client." Labels answer "what is this post about." A label is an org-scoped tag with a name and a colour, applied to posts across any group — a campaign name, a content series, a launch, a seasonal push.

The agency value is in the counts. When every post in a campaign carries the same label, you can see how many posts the campaign has produced, across which clients, without opening each client's calendar. A monthly retainer review becomes: filter by label, read the list, write the summary.

Labels are cheap to apply at compose time and expensive to backfill. Add them when the post is drafted, not when the report is due.

Roles: who can do what

PostHub's role ladder has five rungs, ordered by what they can do:

• Viewer — read access: calendars, posts, analytics.
• Approver — can approve posts without editing them.
• Editor — can create, edit and schedule posts within the limits their role allows.
• Admin — can manage groups, labels and team members.
• Owner — full control, including billing.

The agency pattern that works: the account manager who owns each client relationship is an Editor on the groups they manage; the person who signs off on the client's behalf is an Approver; the person who built the workspace is the Owner; freelancers who contribute drafts are Editors scoped to their client's groups; and anyone who only needs to see the calendar is a Viewer.

Only the Owner and Admins can invite new members. Invitations are seat-capped — your plan's seat limit is the ceiling on how many people can be in the workspace at once, and the role each person receives is set at invite time. A custom role label can be applied to make internal titles legible in the member list, but the permissions underneath are the five above.

Approvals per client

The approval workflow is the control that catches a crossed post before it publishes. It has three modes at the workspace level:

• None — posts publish as scheduled, no review step.
• Loose — posts can be approved by one person, including the person who created them if self-approval is on.
• Strict — a second pair of eyes is required, and self-approval is off by default.

Three switches refine each mode: send requests by default (new posts route to the approver automatically rather than waiting for someone to notice them), guest approving (a client or stakeholder who is not a workspace member can be given a review link — useful when the sign-off belongs to someone outside your team), and lock on approval (once a post is approved, the draft is locked so a late edit cannot change what was signed off).

Apply these per client through the group override, not the workspace default. A workspace-wide Strict setting makes the easy clients slower; a workspace-wide Loose setting makes the regulated clients dangerous.

The plan math

How much structure you get depends on the plan:

• Starter — 5 seats, 1 group, 10 posts per platform per month, no X.
• Professional — 10 seats, 5 groups, unlimited posts, no X.
• Agency — 25 seats, unlimited groups, all platforms including X.

The group count is the constraint most agencies hit first. Five clients fits comfortably on Professional; a sixth client means either merging two groups or moving up. The seat count is the second: an account manager, an approver, a strategist and two freelancers is already five people, which is Starter's ceiling. And if any client needs X, the Agency plan is the only one that carries it.

The pricing page has the full comparison; the point here is that the structure above maps directly onto those limits, so choosing the plan is choosing how many clients you can separate cleanly.

The weekly operating rhythm

Structure only works when someone checks it. The agency rhythm that keeps groups honest:

Monday — review each client's queue for the week. Confirm the posts sit in the right group, carry the right label, and route to the right approver. Two minutes per client.

Wednesday — mid-week check: has anything failed to publish, does anything need a reconnect, has anyone outside the team been added as a guest approver for a sign-off that is due.

Friday — pull the week's published posts per client, using the label filter where a campaign ran across groups. Note what performed, note what crossed a boundary it should not have, and carry the correction into next week's queue.

The rhythm is deliberately short. An agency weekly that takes an hour per client will be skipped by week three; one that takes fifteen minutes per client survives.

Where PostHub fits, and where it does not

PostHub gives you the pieces: groups with timezones and per-group approval overrides, org-wide labels with post counts, a five-rung role ladder, guest approving for client sign-off, and a calendar that shows every client's queue in one view. The collaboration features and the team approvals guide cover the mechanics in full.

What it does not do is build the structure for you. Someone has to decide that Client A gets a group and Client B gets a label, that the account manager is an Editor and the client is an Approver, that this retainer runs Strict and that one runs Loose. Those are decisions, not features — and they are the difference between a workspace that holds five clients safely and one that holds five clients precariously.

Key takeaways

• Build one group per client before connecting the first account; retrofitting groups onto an existing workspace is a week of work no one volunteers for.
• Groups carry a timezone and a default assignee; the per-group approval override lets each client run the review chain their situation requires.
• Labels answer "what is this post about" and their post counts turn a monthly retainer review into a filter-and-summarise exercise.
• Five roles, ordered by capability: viewer, approver, editor, admin, owner. Only owner and admins can invite, and seats are capped by plan.
• The weekly rhythm is Monday queue review, Wednesday health check, Friday label-filtered summary — fifteen minutes per client, not an hour.

FAQ

Can one person work across multiple client groups?

Yes — workspace membership is not scoped to a single group. A person can be an Editor on Client A's groups and a Viewer on Client B's, or an Editor across all of them. The role is set per person; the group membership determines which accounts and calendars they can touch.

What happens if someone publishes to the wrong client's account?

If the approval workflow is on for that group, the post has to pass review before it publishes — which is the moment a crossed post becomes visible. If the group runs with no approvals, the publish goes out, and the failed-publish guide covers what to do once it has happened. Prevention is structural; the guide is the backup.

Do I need a separate workspace for each client?

Not necessarily. One workspace with groups per client is the common arrangement and keeps your team's routine in one place. Separate workspaces become worth it when a client wants you inside their own workspace — and in that case, they invite you rather than you creating a second workspace yourself.