Workspace
People & permissions
Invite team members, choose the right role, change access and distinguish login accounts from public authors.
What People manages
People manages the accounts that can sign in to the CMS: their email, role, enabled state and sessions. Only an administrator can manage people. Authors is a separate screen for public bylines and biographies. Creating a public author profile does not create a login, and inviting a person does not automatically publish their biography.
Access is checked on the server for each operation. A visible sidebar link does not grant permission. The current account role, the type of resource and its ownership all matter. API scopes add a further restriction when an integration makes the request.
Sources: Role and ownership policy; People screen; Authentication and current-account resolution.
Choose a role by responsibility
| Role | What it can do | Important boundary |
|---|---|---|
| Admin | Manage workspace content, design, people and credentials, and view audit records. | Use individual accounts so changes can be attributed; Activity log does not provide an edit-audit-record action. |
| Editor | Manage and publish non-design content, including pages, posts, terms and public profiles. | Does not manage templates, shared sections, menus, brand or site settings. |
| Author | Create, edit and publish their own posts; prepare and submit their own public profile. | Cannot manage other people’s posts, pages or design; some post fields remain restricted. |
| Contributor | Create and edit their own unpublished posts, then submit for review; prepare their own profile. | Cannot publish or upload media, and cannot edit a post once it has a published revision. |
| Designer | Manage and publish templates, shared sections, menus, brand and site settings. | Reads permitted ordinary content but cannot edit Pages or Posts. |
Authors and contributors can read terms for classification, but cannot manage the taxonomy itself. Their public profile can be submitted for review, not self-published. The media service also applies ownership and public-reuse rules; broad content permission is not a promise that every private upload is visible. Consult the Media library guide when collaborating on assets.
Sources: Role and ownership policy; Content ownership and protected fields; Media access policy.
Invite someone
- Open People and the invitation form. Enter the person’s email and select the role that matches their work. Contributor is the initial selection.
- Choose Send invitation. The application emails a one-use invitation that expires after 72 hours. Production email delivery requires working SMTP configuration.
- The recipient opens the link, enters their name and a password of 12–128 characters, then accepts. They sign in using that account on this installation.
- Check Your team for the new account. Pending invitations appear in their own paginated list. Cancel invitation revokes an unused link.
If an invitation expires, send a fresh invitation. Creating a replacement revokes older pending invitations for that email. If sending fails, the failed invitation is revoked. The inviting account must still be an enabled administrator when the invitation is accepted. During local development, mail normally arrives in Mailpit rather than a real inbox.
Sources: People screen; Invitation and access-change service; Account forms.
Change or remove access
- Use Find a person, enter a name or email, and choose Search people. Search applies to the whole matching dataset before pagination; use the separate people and invitation page controls.
- To change responsibility, choose a new role beside the person and select Save role. Existing sessions are signed out so stale permissions do not persist.
- Use Disable account to stop sign-in and revoke sessions. Enable account restores the ability to sign in. Disabling does not delete the person’s content.
- Use Sign out sessions when browser access should be reauthenticated without disabling the account. Subsequent requests using those sessions require a new sign-in. This action does not revoke API keys; manage integration credentials separately.
You cannot use this screen to demote or disable your own administrator account, and the system protects the last enabled administrator. Arrange a second administrator before handing over control. An enabled account with an unexpectedly limited screen should first have its role and the record’s ownership checked; repeatedly signing in will not grant additional authority.
Sources: People screen; Invitation and access-change service; Role and ownership policy.