One blog, several people, and nobody holding keys they do not need.

• A business with a few writers. The owner, a marketing hire and a freelancer, each with their own login and only the access their job needs.
• Teams where one person approves. Writers save drafts; an editor reads them and decides what goes live.
• Agencies and freelancers running blogs for several clients, with each person let into only the clients they work on.
• A developer who wires up the site and needs the API keys, but has no reason to edit or publish posts.

Six ready-made roles, the same in every account. What each can do, straight from the permission list the API checks:

Editors also manage categories, tags and authors, since those are content. Admins and developers can change a website’s settings; admins can also delete a website. Owner, admin and developer can read the activity log.

Publishing is a permission of its own, separate from writing. Somebody without it sees Published and Scheduled greyed out in the editor, with the line “Your role can write drafts; an editor publishes.” If they try anyway, through the API or an AI assistant, the API refuses. Scheduling counts as publishing, because the post goes live later without anyone pressing a button.

The account owner can make roles of their own under Team → Roles → New role: a name, a line on who it is for, and a level for each area of the dashboard (View, Full, or Custom to pick exactly which permissions). Four starting points are offered:

Changing a role changes it for everybody who holds it. For a one-off difference, such as an editor who may not delete, the owner adds an exception for that one person while inviting them or later.

One rule keeps this safe: nobody hands out what they do not hold. An admin cannot invite somebody with access to billing, because admins do not have it. A role they cannot give is shown, greyed out, with “Has permissions you do not hold yourself.”

1. 01

   Open Team → Add member and type their email

   They need a CMSKite account, which is free. If nobody uses that address yet, the page says so: ask them to sign up with it, then add them.

2. 02

   Choose a role

   A built-in role or one of yours. Under the cards, the page lists what the chosen role can open.

3. 03

   Choose where they can work

   Every workspace, including any made later, or Only the ones I choose, and inside each workspace, all its websites or only some.

4. 04

   Send invitation

   It appears in their CMSKite notifications and arrives by email. It lasts a week and can be used once. Until they accept or you cancel it, it holds a seat.

Each website is its own project, with its own posts, categories, authors, API keys, AI writing brief and free blog link. A workspace groups websites. Seats belong to the account, not to one workspace, so the same person can work across several.

For an agency that means one login per person and access set per client. A freelance writer can be an editor on two clients’ websites and see nothing of the rest. Reader numbers follow the same line: somebody let into some websites sees the figures for those websites only, even in totals.

The name shown on a post is an author, and an author is content, not a user account. Add one under Categories & tags → Authors. A guest writer, a pen name or a doctor who reviews your posts can be credited without an account, a password or a seat. An author can be linked to a team member when they are the same person.

Today a post’s author is set through the API or an AI assistant (the authorId field); the post editor in the dashboard does not have an author picker. The Posts list shows each post’s author. More in Categories, tags and authors.

• Activity log. Each website’s overview lists recent changes to its posts, keys and settings, for owners, admins and developers. The log is kept for 24 months.
• Removing someone ends their access. Their posts stay: posts belong to the website, not to whoever wrote them.
• AI assistants act as a person. An AI tool you connect is limited to what you allowed and to your current role, checked on every request. Change somebody to Viewer and the assistant they connected loses write access on its next call. See for developers.

The owner counts as a seat, and so does each invitation waiting to be accepted. When every seat is taken, the Team page says so; remove someone or add seats on the Plan page.