User Roles & Permissions
User roles and permissions determine what individual CMS users are allowed to see, create, change, publish, or administer.
They help separate routine editorial work from higher-risk administrative actions.
Common Permissions
CMS permissions may control whether someone can:
- Create content
- Edit their own content
- Edit other people's content
- Publish
- Delete content
- Upload media
- Manage users
- Change themes
- Install plugins
- Edit configuration
- Export data
- Manage integrations
Different CMS platforms organize these capabilities differently.
Ghost, for example, documents separate Contributor, Author, Editor, and Administrator roles.
Why It Matters
Not everyone who needs to change a webpage also needs permission to:
- Install code
- Delete users
- Modify integrations
- Change global settings
- Export the database
Limiting permissions reduces accidental changes and makes responsibility clearer.
Principle of Least Privilege
A useful approach is to give each user the minimum permissions necessary for their role.
Someone responsible for publishing articles should be able to publish articles.
They do not necessarily need full system administration.
Platforms with more advanced permission systems can limit access by team, content type, or other conditions. Contentful, for example, supports roles and content permissions.
Common Problems
Common problems include:
- Every staff member being an administrator
- Shared logins
- Accounts belonging to former employees
- Developers retaining access indefinitely
- Nobody knowing who owns the primary account
- Plugins or integrations using unnecessarily powerful credentials
- One owner account becoming a single point of failure
How to Improve
Review users periodically.
Remove stale accounts, avoid shared credentials, and assign roles according to actual responsibilities.
Document who owns:
- Billing
- Domain access
- CMS ownership
- Integrations
- Publishing
- Technical administration
Access is part of system ownership.