The group needs a unified backend management system for multiple brand stations, how to configure permissions and site isolation?

How to configure permissions and site isolation for a unified background management system for multiple brand stations? It is divided into three layers: the site boundary determines who can see which stations, the role boundary determines what can be done after entering, and the operation domain boundary determines which actions at the entire site level must be authorized separately. Mixing the three layers together is a major source of permission accidents at the group site.

AnQiCMS supports multi-site management, which can manage multiple independent sites and is suitable for scenarios of multi-brand, multi-theme websites. There are corresponding configuration locations for these three levels.

First define the boundaries of the site: what content can be shared

The most common needs of the group site are to 'share some parts and isolate some parts'. Suitable for global unification are the material library, template components, sensitive word rules and content review strategies; it is necessary to isolate the column structure, editing permissions and visible information to the outside (main body name, contact information, filing information).

The judgment criteria for the impact of errors: if a change affects multiple brands at the same time, it should be classified as global and additional change approval should be added; if it only affects the site, it should remain at the site level. Placing brand-specific content into the global configuration has a much higher cost to dismantle later than initially configuring it multiple times.

Further define role boundaries: converge according to user groups

AnQiCMS provides user management and VIP grouping, and can set access permissions for different user groups. In the group scenario, a practical approach is to build groups according to responsibilities rather than assigning rights according to individuals.

External contributions of this kind are especially worth setting up separately: only drafts are allowed to be written, and after being reviewed and published by our editors, it can retain the source while controlling the quality of external communication. The distinction between drafts and formal content is already available in the background, and no additional procedures need to be followed.

The VIP group capability of the user group can also be used for the visibility range on the member side: user levels of different brand stations are not interconnected, avoiding a high-level account of one site from obtaining reading permissions that should not be had on another site.

The third layer: the boundary of the operational domain

Backup, upgrade, and multi-site management operations such as these affect the radius and cover the entire matrix. AnQiCMS' approach is to set the exposure range by intent domain, with high-risk domains turned off by default and explicitly turned on when needed.

This layer is often misunderstood as 'trouble'. Its real function is to take high-risk actions out of the daily path: default off means that daily operations, no matter how mistakenly clicked, cannot reach the whole station level capabilities. It must be actively turned on and executed by authorized personnel, and then closed after execution. This point is particularly important in a multi-site scenario, as a cross-site misconfiguration will change all brand stations at the same time.

The配套also needs to be checked at the interface layer: when external clients connect, token authentication is used, the scope of token authorization is convergent by domain, and do not put operational purposes and content purposes into the same long-term token.

What needs to be verified after the isolation is configured

Three drills, missing one does not count as configured.

The first is a cross-site privilege escalation exercise: attempting to access another site with a brand editor account should fail and leave a log. The second is a recovery exercise: using the backup of a site in an isolated environment to restore, confirming that the recovery results will not bring out data from other sites - in a multi-site environment, the granularity of the backup is not correct, and the recovery will be site-bound. AnQiCMS's backup and recovery support processing data along with static files, and verification is performed separately by site during the exercise. The third is a release link check: when a new brand site goes online, confirm that it does not inherit any content that should not be exposed in the global configuration, such as other brand contact information remaining in the shared template.

Common questions

Ask: Should a new brand website copy a site configuration?Answer: It is recommended to create from a templated site definition. Manual copying is easy to bring in permissions and historical settings from the source site, and creating from a unified entry can only inherit the parts that need to be inherited.

Ask: Would it be too radical to change the sensitive word rules globally?Answer: On the contrary, centralized maintenance is more controllable than site-by-site maintenance. What needs to be done is to check the change records and the scope of application, rather than copying the same rules multiple times.

Ask: Can the operations and content permissions be given to the same person?Answer: In reality, small teams often merge, but it is necessary to leave traces: when the all-site operation is enabled, record the approver, review according to the records after the event, and avoid the situation where only one person can do it and no one knows that it has been done.