Control 1
Schema validation
The agent emits validated block JSON against a governed schema. Invalid output is impossible to produce, not merely discouraged — the system's shape rejects it before it exists.
Before you let an AI agent near your website, you will ask one question: how do I stop it publishing something wrong? The answer that matters is not a policy someone has to remember. It is a set of structural guarantees — things the system cannot do, rather than rules a person has to follow.
An agentic CMS earns trust the same way any governed system does: by making the unsafe outcome impossible to produce, not merely discouraged. The five controls below are each a mechanism, not a promise. Together they answer the due-diligence question directly.
Five controls, one system
Each control closes a different failure mode, and they only work as a set. Validation stops malformed output; the design system stops off-brand output; draft-by-default stops unreviewed output; scoped access stops over-privileged output; and the audit log makes whatever did happen attributable and reversible. None of them depends on anyone remembering to be careful.
Control 2
Generated design system
Every page is on-brand by construction. The agent cannot invent a colour, a font or a layout, because those are resolved from the brand's own tokens, not authored by the model.
Control 3
Draft by default
Agents compose drafts; people approve and publish. A human review gate is a first-class part of the workflow, so nothing reaches a visitor unreviewed.
Control 4
Scoped access
Real role-based access control and scoped, revocable API keys. The agent acts with exactly the permissions it was given and no more, and those permissions can be withdrawn at any time.
Control 5
Audit and rollback
An append-only audit log attributes every change to a named actor, and instant rollback reverses any release. Evidence travels with the content, so a bad publish is contained and reviewable.
What agents should not be trusted with
Credible reassurance draws a line. Two things stay with people, not because the system is weak but because the risk is not a technical one.
- Final publishing decisions on regulated or legal content. An agent can draft and prepare it, but the decision to publish belongs to a person accountable for it.
- Anything requiring facts the system has not been given. An agent can only be as accurate as the evidence it was handed. Where a fact is not in the system, the agent should not be asked to invent one.
These are not gaps in the controls. They are the boundary where governance stops being a mechanism and becomes a judgement — and the right answer is to keep that judgement human.