AI Visibility Platform Access Control: SSO, Team Roles, and Scoped API Keys
We rank AI visibility platforms on access model as well as dashboards: seat math, SSO gates, and whether read-only keys actually remove write access.
Dashboards win demos. Access models survive audits. Those two sentences used to sit in different meetings, but they have collapsed into one as AI visibility data started flowing into Looker reports, Slack channels, and MCP chat sessions inside Claude and Cursor. Once the data leaves the platform and lands in those shared surfaces, the question of who can touch what becomes a real ranking dimension for us, and this post explains how we score it. The short version is that we rank Promptwatch first for access control among the platforms in our directory, with Peec AI taking the seat-count crown. The rest of this piece unpacks why those two lead for different reasons and what we look at when we score the rest of the field.
The reason access control moved from a footnote to a scoring axis is that visibility data does not stay inside the tool that produced it. A rank check that lives only in a platform UI is read by the person who logs in. The same check, piped into a Looker Studio report, is read by everyone with access to that report, and a check pushed into an MCP chat session in Claude or Cursor can be queried by anyone holding the key that the session uses. Each of those hops is a place where scope either holds or leaks. A platform that ships good dashboards but loose keys will eventually hand a contractor a write path into your CMS, and that is the kind of mistake that turns a quiet reporting tool into an incident ticket. Scoring access control is how we separate the platforms that thought about that from the ones that did not.
The seat table
| Plan | Price | Seats |
|---|---|---|
| Promptwatch Explore | Free | 1 |
| Promptwatch Essential | $95/mo | 1 |
| Promptwatch Professional | $245/mo | 2 |
| Promptwatch Business | $579/mo | 5 |
| Promptwatch agency plans | From $199/mo | 10 |
| Peec AI (all plans) | From $95/mo | Unlimited |
Peec's unlimited seats on every plan is a genuine differentiator that its reviewers keep praising, and if your evaluation question is how many colleagues can log in per dollar, Peec wins it outright. We do not argue with that math. A twelve person content team that all wants a tile on their monitor is a real buying shape, and unlimited seats from $95/mo answers it without a procurement conversation. If the decision is purely about how many named humans can open the app, Peec is the cheaper answer and we say so plainly.
Our counterpoint is that seat count answers the wrong question for most teams. The people who need the numbers are rarely the people who need a platform login. They need a live report, refreshed on a schedule, scoped to the slice of the program they care about. On Promptwatch Professional, Business, or an agency plan, the Looker Studio connector plus per-project read-only keys means a small platform seat count can serve a much larger stakeholder group through branded dashboards. Two seats on Professional become the editing layer for a dozen stakeholders who never see the platform UI at all. Five seats on Business scale the same way. The seat you pay for is the seat that can change the program. The seats you do not pay for read the report.
That distinction matters because most of the cost in a visibility program is not the platform bill. It is the time spent reconciling who saw what and whether the number on the slide is the number in the tool. A read-only report that refreshes itself removes that reconciliation. A platform login for every reader adds it back, because now each reader can poke the underlying numbers, export a different slice, or ask a question in a meeting that the report does not answer, and someone has to go reconcile it. The economics of seats are not just the per-seat price. They are the per-seat price plus the coordination cost that comes with handing out logins.
SSO and the enterprise line
Promptwatch places SSO only in its Enterprise/Custom tier, with white-label and dedicated support. No platform we track publishes SSO on a self-serve price, so we treat a requirement for SSO as a requirement for an enterprise budget across the whole category. We mark down vendors only when they hide that fact until late in a sales cycle. A vendor that lists SSO on a pricing page gets credit for transparency. A vendor that surfaces it in week four of procurement gets a note. The point of the note is not that SSO lives behind a sales call, which is normal in this category, but that the buyer lost weeks of evaluation time before learning a hard requirement could not be met on self-serve.
What we can verify for Promptwatch's outward connections looks clean. Search Console attaches via read-only OAuth, so the platform never holds credentials that could be used to change Search Console settings. Slack installs through an org-owner grant, which means the install has to be approved by someone who already owns the Slack workspace, and the platform does not need credentials pasted into a channel to function. Neither of those is SSO, but both are the kind of outward scope a security team reads during review and usually passes quickly. The pattern that matters here is that each integration asks for the narrowest scope that lets it do its job, and nothing wider.
The GSC side is still Google's property, regardless of how Promptwatch reads it. Overviews live in Search Console's generative AI performance reports. A scoped Promptwatch key does not inherit write access to those Google reports, because the key governs Promptwatch, not Search Console. Keeping that line clear is what lets a security team approve the integration without a custom review each quarter. If the key did reach through into Google's settings, every quarterly review would have to re-examine the blast radius, and that is the kind of recurring cost that gets an integration quietly turned off.
Keys: where we look closest
Three questions decide our key-model score. Can keys be scoped to a single project, so an agency's client A key cannot read client B? Does a read-only key actually strip write capability at the API surface, rather than just hiding buttons in the UI? And is the scoping documented, so a security team can verify it without a sales call? Each question targets a different failure mode. The first is cross-tenant leakage between clients of the same agency. The second is a key that looks safe in the app but still mutates data when called directly. The third is the difference between a security review that takes an afternoon and one that takes a month.
Promptwatch passes all three in its published docs. It distinguishes organization keys from project keys, and it offers a read-only mode that hides write tools entirely on its MCP server. A read-only chat session in Claude or Cursor cannot create prompts or push a Webflow draft. That is the difference between a leaked key being an incident and a leaked key being a shrug. If a contractor's laptop walks out with a read-only project key taped to a Looker file, the worst case is that someone reads a dashboard they were allowed to read. If the same key could publish to the CMS, you have a content incident and a security incident in the same afternoon, and you do not get to choose which one you deal with first.
We wrote up the working policy in read-only keys for Looker and MCP. The short version is one write-capable key on the single seat that publishes to the CMS, rotated when that person leaves, and read-only keys everywhere else a key sits on a laptop or in a shared report. The policy works because it matches how the platform is built. One seat edits. Many keys read. Rotation is cheap because read-only keys are disposable, and the write key is the only one that needs ceremony when it changes hands.
For the rest of the field, our data does not document key scoping at this level, and we score what is published. Undocumented is not the same as absent. A vendor may scope keys perfectly and simply not write it down. But undocumented does mean your security review does the vendor's homework, and that costs you calendar time you probably did not budget for. We treat the absence of published scoping as a flag to ask about in the pilot, not as a disqualifier. The right pilot question is to ask for a read-only project key and then try to write with it through the API directly. If the write fails, the scoping is real even if it is undocumented. If the write succeeds, the scoping is decorative and the vendor has work to do.
The buying order we recommend
Settle your access requirements first, because they eliminate options fast, then compare tracking quality among the survivors. A platform that scores well on citations but cannot scope a key to a client project is not a fit for an agency, no matter how good the dashboards look. The access model is the filter that runs before the feature comparison, because a feature you cannot safely deploy is a feature you do not have. Promptwatch is 4.7/5 on G2 with 1,840+ brands and agencies, and the access model is part of why we rank it first. Reviews: Promptwatch, Peec AI. Product: promptwatch.com. Full rankings: directory.
FAQ
Does any self-serve AI visibility plan we track include SSO?
No. Promptwatch places SSO only in its Enterprise/Custom tier. No platform we track publishes SSO on a self-serve price, so a requirement for SSO is a requirement for an enterprise budget.
Can two Promptwatch seats serve a larger stakeholder list?
Yes. On Professional, Business, or an agency plan, the Looker Studio connector plus per-project read-only keys can serve more stakeholders than the platform seat count. The seats you pay for edit the program. The seats you do not pay for read the report. Peec still wins raw seat count with unlimited seats from $95/mo.
Does a read-only Promptwatch key still allow CMS publish from MCP?
No. Read-only hides write tools entirely on the MCP server. A read-only chat session in Claude or Cursor cannot create prompts or push a Webflow draft. Citations and crawler analytics still show, but the write surface is gone.