Organizations
Product access
What an admin can restrict. Keeping a member out of a product, giving them some Spaces only, and switching a product off for the whole Organization.
A member's role is the same in every product and every Space. An admin can narrow that down in three ways:
| Restriction | Applies to | Set on |
|---|---|---|
| Product access | One member | www: the Organization's People tab |
| Roles per Space | One member | Content: Settings → People |
| Switching a product off | The whole Organization | www: the Organization's Products tab |
None of them deletes anything: undo one and everything is where it was.
Keeping a member out of a product
On the People tab, an admin unticks the products a member may not use: Improve, Content & Media or Numbers. Their role stays the same in the products they keep.
For a product they're kept out of, they are not a member at all: the Organization doesn't show up there, its Spaces answer as if they didn't exist, and that goes for the dashboard, ⌘K, their agents and the tokens they made. Media follows Content: keep someone out of Content and they're out of Media too.
Use it for a copywriter who only needs Content, or a marketer who only needs Improve and Numbers.
Roles per Space
By default a member has their role in every Space of the Organization. An admin can give someone a role in some Spaces only, under Content's Settings → People. From then on they see only those Spaces, in every product, with the role they were given in each: developer, editor or reader. It can be more than their Organization role, say a client's editor who is a developer in their own Space.
Agencies use it to give a client's people their own Space and nothing else.
- Admins are always in every Space. To restrict an admin, make them something else first.
- A member keeps at least one Space: to take their last one away, remove them from the Organization.
- A member restricted to some Spaces who creates a Space becomes its developer.
- Transferring a Space to another Organization drops its roles per Space: there, members have their Organization role in it.
See roles per space in Content's docs.
Switching a product off
On the Products tab, an admin switches Improve or Content off for the whole Organization. Its dashboard, ⌘K, the MCP tools and the agent API then refuse it (product_disabled) for everyone, while your sites keep working: Improve's datafile and Content's delivery still answer.
- Nothing is deleted. Switching it back on brings everything back as it was.
- An Organization keeps at least one of Improve and Content on.
- Numbers and Media have no switch: Numbers comes with either product, Media with Content.
- With Improve off, Content no longer offers the A/B test or flag block in its block menu. See How the products work together.
What isn't restricted per member
- Environments. A role applies in
develop,stagingandproductionalike; Content's reviewed publishing is how you keep production to admins. - Agents. An agent can do what its person can, never more; there is no separate agent role. What you can limit is the grant: a read-only connection, or disconnecting it. See What an agent may do.
- Two-factor authentication can't be required for an Organization yet. Each person turns it on for their own account.
For agents
Admins' agents set product access with updateMember ({ "products": ["improve"] }, or null for every product) and roles per Space with content_listSpaceMembers and content_setSpaceAccess.