External account creation and access for an operator

Hi,

             I am bit confused in how the external accounts and operators are linked together. E.g. If I have an operator and he can access campaign through browser, he is already having an access to campaign. So, do I need to create an external account for him ?

Also, in which cases, do I need to really create an external account for an operator and what kind of access is then granted to him because of external account.

Is it needed for API access ? If yes, is there a session token required to be passed and what if client does not want to pass the session token always.

sorry if I am mixing few things together but I am not clear about the linking and the access and even after going through the documentation, I am but confused.

Regards,

Piyush