Headless CMS User Roles and Permissions: 9 Platforms Compared

Every headless CMS has user roles. What differs is how fine the permissions go, which plan unlocks them, and whether you set them in a UI or write them in code. We compared nine platforms on those points using each vendor’s own docs and pricing pages, checked on 22 October 2026.

Three terms first. A role is a named bundle of rights, such as Editor. A permission is one allowed action, such as publish. A scope is where that action applies: a content type, a field, a locale, an environment or a single entry. Most of role design is choosing scopes. New to the category? Start with what is a headless CMS.

How roles and permissions work in a headless CMS

Nearly every platform here uses role-based access control (RBAC). You define roles, attach permissions, and assign users or teams. Some add conditions on top, such as “only entries this user created”.

We define roles by working back from tasks:

1. List the jobs: write drafts, translate, review, publish, manage media, change the schema, manage users.
2. Give each job the narrowest scope. A translator needs one locale, not the whole space.
3. Group jobs into as few roles as you can. Ten users with ten unique roles will hurt at audit time.
4. Log in as each role and try to break it before launch.

Sanity and Directus are additive. A second role or policy can grant access but can never take it away, so one stray Editor assignment undoes a careful restriction.

RBAC capability matrix

Verified October 2026 against the docs and pricing pages linked in each platform section. “Not documented” means we could not confirm the capability in the vendor’s docs. It does not mean the feature is missing.

If developers run the CMS, Payload and Strapi give you custom roles with no licence cost when you self-host, and Payload goes furthest because access rules are code. A marketing team on SaaS gets the clearest permission screens in Contentful and Storyblok, but custom roles start at Premium on both. A regulated enterprise can get workflows, audit trails and SAML SSO in one contract from Contentstack, Hygraph or Sanity Enterprise.

Strapi

Strapi ships three admin roles. Author manages its own content, Editor manages and publishes any content, and Super Admin has everything. The docs list RBAC as a free feature, so custom roles work on the self-hosted Community plan. Permissions reach individual fields and, with Internationalization installed, single locales. Two built-in conditions limit a role to entries the user created or entries created by the same role. Review Workflows and Audit Logs need Enterprise.

The catch is that approval stages cost an Enterprise licence. Sources: Strapi RBAC docs, Strapi self-hosted pricing. Our service: Strapi CMS development.

Contentful

The default space roles are Admin, Editor, Author, Translator and Freelancer, and your plan decides which you get. Free has Admin and Editor, Lite adds Author, and Premium adds the rest plus custom roles. Custom role rules can target entries, content types, fields, tags and locales, on the master environment or selected ones.

The catch: anything past the default roles needs Premium. Sources: space roles, content permissions. See our Contentful services and Strapi vs Contentful.

Sanity

Administrator and Viewer exist on all plans. Growth adds Editor, Developer and Contributor, and a Contributor can write drafts but not publish. Custom roles and content resources are Enterprise. A content resource is a GROQ filter that narrows which documents a role can touch. You can set permissions per dataset, so staging and production can differ.

The catch: we found no field-level permissions in the docs. Sources: Sanity roles docs, Sanity pricing. See Sanity development and Strapi vs Sanity.

Storyblok

Owner, Admin and Editor are fixed. Custom roles add allow and deny lists for languages, folders, stories, blocks and block fields. When a user holds several roles and any one denies a resource, the denial wins. Custom roles, custom workflows and SSO come with Premium and Elite.

The catch: the roles page says nothing about permissions per workflow stage. Sources: Storyblok roles, Storyblok pricing. Our service: Storyblok development.

Payload CMS

Payload has no predefined roles. You write access functions per collection, global and field, for each operation. A function can return a query, which gives row-level rules like “users see only their own orders”, and it can read the request locale. The Admin Panel hides collections a user cannot access. The core is MIT licensed, while SSO and Publishing Workflows are Enterprise features.

The catch: the Local API skips access control unless you set overrideAccess: false. Sources: Payload access control, Payload Enterprise. Step-by-step Payload RBAC setup lives on our Payload CMS development page, or you can hire a Payload developer.

Directus

Directus combines roles with policies. Each permission covers one collection and one action (create, read, update, delete or share), lists the allowed fields, and can carry filter rules for item-level access. A policy can also restrict by IP and require two-factor login. Users with Studio access count as seats, and API-only users do not.

The catch: SSO is not on Core and starts at the Team tier. Sources: Directus access control, Directus pricing. See Directus development.

Contentstack

Owners, Admins and Developers can create roles. Permissions cover entries, assets, folders, languages, taxonomies and publishing environments, and exceptions narrow a role to specific entries or fields. Workflows assign stages to users or roles, need at least two distinct reviewers to move content forward, and write each stage change to the Audit Log. SSO runs on SAML 2.0 with role mapping per identity provider.

The catch: the role docs name no plan, and workflows are “available only if included in your plan”. Sources: create a role, workflows. See our Contentstack page.

Hygraph

Every project gets five system roles that cannot be edited. Custom roles are Enterprise only and scope content permissions by model, locale, stage, environment and condition. Content permissions are set per environment, while Management API permissions apply to the whole project.

The catch: the docs do not mention field-level scoping. Sources: Hygraph user roles, Hygraph pricing.

Webiny

Webiny sets access in roles, which the 5.x docs call user groups. A Headless CMS role can be limited to chosen content model groups, models, entries and locales, and to publish or unpublish. The pricing page lists role based access control as not included on Community. Publishing workflows start at Business, and audit logs, team management and SSO are Enterprise.

The catch: the free edition has no RBAC. Sources: Webiny user creation, Webiny pricing. See our Webiny page.

Field-level vs collection-level vs content-type permissions

Content-type permissions decide who can touch a whole model, such as Articles. Field-level permissions decide who can see or edit one field, such as a price. Row-level rules decide which entries, such as one region’s.

Payload covers all three in code. Strapi and Directus cover them in the admin UI. Contentful handles fields, tags and locales on Premium, and Sanity filters documents but not fields. Weighing the two open-source options? Read Strapi vs Payload.

Separating author, review and publish

A request we hear on most projects: writers must not publish. Every platform here can do that with a role that lacks the publish action. Approval chains are where the money goes. Strapi Review Workflows, Payload Publishing Workflows and Hygraph custom workflows are Enterprise, Storyblok custom workflows are Premium and Elite, and Webiny starts at Business.

On a tight budget, a drafts-only role plus a small group of publishers covers most teams.

Roles for APIs, tokens and service accounts

Treat every token as a user. Give each integration its own token with the narrowest role, and rotate it. The docs flag three traps:

• In Sanity, a token that also holds a broader role, such as Editor, keeps that access even with a restrictive content resource attached.
• In Payload, the Local API skips access control by default.
• In Directus, a field restricted by conflicting policies comes back as null, so clients have to read null as possibly restricted.

An AI agent that drafts content should get a drafts-only role and never publish rights.

SSO, SCIM and audit logs

SOC 2 and ISO audits usually ask for SSO, automatic deprovisioning and a record of who changed what. SSO is a paid tier on every SaaS platform here. Contentful lists SCIM provisioning on its pricing page. The other role and SSO docs we read do not mention SCIM. Audit logs are Enterprise on Strapi, Hygraph and Webiny, and Sanity keeps its full audit trail for Enterprise.

Which plan unlocks roles

Plans as of October 2026, from the vendor pricing pages linked above.

How to choose

If you have developers and need fine rules, pick Payload or Strapi. Our Payload build for a B2B SaaS shows a European mid-market B2B SaaS whose editors now publish without engineers. To staff a Strapi project, hire a Strapi developer.

If you want roles in a UI and can pay for SaaS, look at Contentful Premium or Storyblok Premium. If audit and SSO must come in one contract, shortlist Contentstack, Hygraph Enterprise or Sanity Enterprise.

Coming from WordPress? Our WordPress to headless CMS migration maps old roles to the new model. For a wider shortlist, see top open-source headless CMS platforms.

Why roles and permissions matter

A leaked editor token, or an editor at the end of a long day, should not be able to delete a schema or publish unapproved legal copy. Roles set that limit. Pick the platform whose scopes match how your team works, then keep the role list short. If you want a second pair of eyes on the design, our headless CMS development services team can review it with you.