How to isolate permissions between sites when integrating multiple brand websites into a single backend management system

When merging multiple brand official websites into a single background management system, the isolation of permissions between sites is not a matter of just flipping a switch. It needs to be decomposed into three layers: site visibility range, personnel grouping boundary, and the scope of high-risk operations at the site level. AnQiCMS's multi-site management supports managing multiple independent sites and is suitable for multi-brand, multi-theme websites. After merging, what truly needs to be designed is the corresponding relationship of these three layers.

Merge the background before confirming whether to merge

Scenarios worth merging have common points: the content team is the same group of people, the column structure is similar, and there is a hope for unified rhythm in upgrading and maintenance. The scenarios not worth merging are also clear: each brand has an independent membership system, independent activity price logic, or compliance requires content review traceability and isolation. The benefit of merging is to reduce redundant configuration, the cost is that the permission design needs to be done in advance, otherwise an editor of one brand can change the page of another brand, and accidents will occur here.

How to define the visibility range of the site

The visibility range of the site solves the issue of 'which sites can be seen after logging in'. The reasonable approach is to treat the site as a container for permissions: editors entering the background can only see the brand sites they are responsible for, with lists, categories, tags, and media files following the site. This avoids cross-site search results. It is necessary to view the brand负责人 of two sites at the same time and use the second group authorization instead of granting access to all sites for everyone. The cross-site query capability (such as checking if content already exists by title) is suitable for a few roles, to avoid editors mistakenly posting A brand's copy into B brand.

Editor and review permissions are distributed according to user groups.

AnQiCMS provides user management and VIP groups, which can set access permissions for different user groups, perfectly catering to the two types of divisions in multi-brand scenarios: writing and reviewing. When implementing, it is recommended to design three types of groups: content editors can only create and modify drafts, and after submission, the brand review role can set them as formal releases; site administrators are responsible for the structure, navigation, and tag口径; business or membership operations roles are only authorized to view content when the VIP group is needed. The value of grouping lies in separating who can publish and who can change the structure, reducing the chance of a single误operation affecting the entire site.

Why should the high-risk operation at the station level be managed separately

In a multi-site environment, the highest risk is not changing an article, but the station-level operation: backup and recovery, system upgrade, and the addition, deletion, and modification of configuration for the multi-site itself. AnQiCMS's interface capability is set according to the intent domain to expose the range, and such high-risk domains are closed by default and need to be explicitly opened. There are three design points: first, only give operation and maintenance roles to open, second, there is a change record that can be traced back, and third, the automated channel (such as the MCP interface for AI client access) should not be carelessly opened for high-risk domains. Only after completing these three points can the benefits of merging the background not be offset by unauthorized operations.

Multilingual sites and multi-brand sites are not the same thing

Multi-brand refers to multiple independent sites, while multilingual refers to language versions under the same site. AnQiCMS provides configuration and switching for multilingual sites and supports full-page HTML translation. The confusing point is the permission: content and personnel should be isolated between brand sites, and column structure and keyword tone should be shared between language versions. If both brands need bilingual Chinese-English, the correct structure is to divide stations by brand first, and then open multilingual within each station, rather than using language directories to假冒 brand sites.

Common questions

One editor is responsible for two brands, should he be given two accounts?

It is not recommended. It is more stable to join two groups with the same account, as it leaves a login trace and a clear audit chain, and can also prevent one account from being left open when staff leave.

Will permission isolation affect template reuse?

It will not block. Templates and tags can be shared, and each site specifies its own template scheme; when differentiation is needed, switch through site configuration instead of copying a template and renaming it.

How can we verify whether isolation takes effect after merging?

Take three test cases for regression: confirm that the editor account cannot see the content list of other sites; confirm that the review account cannot modify the column structure; confirm that the high-risk domain is still closed through the automated channel.