Branding agencies team roles: who holds authority?

This guide maps branding agencies team roles to decision authority for clients commissioning or reviewing an agency. A delivery team needs named decision functions, but it does not need this article's labels on its organisation chart. Small agencies may combine work; larger engagements may split it.

What to take away

The client decision owner holds authority to accept the problem, scope, trade-offs and release risk; a person cannot silently approve beyond their authority or specialist competence.
Each function should be mapped to an actual agency or client post-holder, with authority and deputies recorded in writing.
Government and standards-body sources inform role design but do not set private-sector staffing.
If nobody can lawfully accept a gate, the work stays held rather than passing by default.

How this list was built

Geography: brand work for organisations in England, with UK-wide legal guidance and a global accessibility reference. Inclusion method: a function entered the list when an official or standards-body source connected it to a distinct delivery decision.

Exclusions: salary, seniority, headcount and claims that any title is universal. No agencies, workers or clients were interviewed, and there are no affiliate, recruitment or supplier relationships behind inclusion.

1. Client decision owner

The client decision owner is a client-side marketing director, brand director or other named budget or brief owner with delegated authority to accept the problem, scope, trade-offs and release risk. A signed contract or statement-of-work authority schedule should identify that person and their deputy; a RACI can record delegated decisions. GOV.UK's service-team guidance, What each role does in a service team, gives a public-service owner decision authority and final quality responsibility. That is useful role-design evidence, not a private-sector staffing requirement.

Evidence output: a signed scope note and risk acceptance record.

Worked example: a named marketing director holds authority to accept scope, trade-offs and release risk; the deputy is the head of brand; the evidence output is a signed scope note.

2. Delivery controller

The usual agency-side post-holder is the project manager or delivery lead; an account director may coordinate client decisions and escalate exceptions, but holds approval authority only when it is expressly delegated. The delivery controller maintains states, dependencies, decisions, changes and exception queues. Cabinet Office contract-management principles connect outcome ownership, change control and performance reporting in government contracts; a private engagement needs its own measures and remedies.

Evidence output: a decision log, change register and exception queue.

3. Research and evidence owner

An agency brand strategist or research lead is the typical owner: this function fixes the question, population, method, source register and boundary between observation and interpretation within the agreed brief. The authority to set that research approach should be recorded in the research brief or RACI. The Government Service Manual's performance-metrics guidance links measures to purpose and data sources. It covers government services, so it cannot establish a commercial brand outcome.

Evidence output: a source register and research brief.

4. Creative rights owner

The practical agency-side register owner is usually a producer or rights-clearance coordinator; a creative director may select the direction, but that does not itself confer copyright authority. Under the Copyright, Designs and Patents Act 1988, a commissioner is not automatically the first copyright owner unless the position is agreed in writing. An authorised client signatory should accept any residual rights risk through a written assignment, licence or risk acceptance, after qualified IP advice.

Evidence output: a rights register and contributor permission log.

5. Claims reviewer

An agency copy lead or compliance reviewer can perform the claims review independently; the named client marketing director or delegated legal or compliance approver authorises release. ASA/CAP guidance on misleading advertising, titled Misleading advertising, explains the need to substantiate objective claims. The CAP Code (the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing), Section 3, rules 3.1, 3.3 and 3.7, covers misleading claims, omissions and evidence. The review must stay independent of pressure to preserve attractive but unsupported copy.

Evidence output: a substantiation file and sign-off note.

6. Accessibility evaluator

The typical evaluator is an agency accessibility specialist or QA lead; an independent auditor may be commissioned for specialist testing. The Equality Act 2010 applies to disability discrimination and reasonable adjustments; the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 set requirements for covered public-sector websites and apps, using EN 301 549, which incorporates WCAG 2.1 AA, subject to exceptions. Those regulations are not a general private-sector staffing requirement; W3C's Web Content Accessibility Guidelines (WCAG) and its evaluation overview, titled Evaluating Web Accessibility: Conformance Evaluation, describes conformance assessment and relevant expertise.

Evidence output: a defect log and retest record.

7. Privacy lead or required DPO

The client-side privacy lead or data protection manager usually owns operational privacy decisions. UK GDPR and the Data Protection Act 2018 govern data protection; where a Data Protection Officer (DPO) is required, that officer advises and monitors independently while the controller retains responsibility for its decisions. The ICO's DPO guidance, titled Data protection officers, limits mandatory appointment to specified cases. Do not award the statutory title merely because somebody handles project queries.

Evidence output: a record of processing activities and retention schedule.

8. Security incident owner

The agency information security lead or IT operations lead is the usual incident owner for agency systems; the client's security lead or incident commander holds authority for client systems and escalation under the agreed incident plan. This owner maintains detection, containment, escalation, continuity and restart authority within that delegation. NCSC incident-management guidance, titled Incident management, recommends defined responsibilities and empowered decision makers. Record deputies and supplier contacts before an incident occurs.

Evidence output: an incident log and escalation matrix.

Apply the map

Write the actual person's name, post, delegated authority, deputy and evidence output against every applicable function. Put delegation and approval gates in a contract schedule or statement of work, and use a RACI, sign-off form and decision log to record who is responsible and who approves. Add specialists when the sector, audience, channel or asset demands them.

Record the client decision owner's authority and deputy in the contract or statement of work.
Name the agency project manager or delivery lead and record authority for changes and exceptions.
Name the brand strategist or research lead and record the research method and source register.
Assign a producer or rights-clearance coordinator; record permissions and rights-risk acceptance.
Name the claims reviewer and client release approver; retain the substantiation file and sign-off.
Name the accessibility evaluator and client release decision-maker; retain defects and retest records.
Identify the privacy lead and, where required, the formally appointed DPO; retain processing and retention records.
Name agency and client incident leads, deputies and supplier contacts in the incident plan.

Common questions

Why does the article avoid ranking the functions?

The entries are non-ranked and their order follows a typical engagement from authority through delivery and incident response. Applicability turns on the commissioned work.

Can a small agency combine these functions?

Yes. The article says a delivery team needs named decision functions but not its labels on an organisation chart.

What happens if no one can lawfully accept a gate?

The article says a gate must have a lawful and competent acceptor. Without one, the work does not advance.