Security & Workspace Governance
Roles and Permissions Matrix
Jumsom enforces dual-gate security across all modules. Workspace plan entitlements dictate system capability, while granular Role-Based Access Control (RBAC) ensures authorized actions across your team.
Module Permission Matrix
Compare access rights and interactive capabilities across all workspace roles.
| Module / Action | Owner | Admin | Editor | Viewer |
|---|---|---|---|---|
CMS Integrations Add CMS, edit credentials, test/re-verify connection, disconnect platform | Full Access | Full Access | Restricted | Read-only message |
Knowledge Base Management Add client profile, re-embed documents, clear embeddings | Full Access | Full Access | Full Access | Read-only message |
Knowledge Base Client Deletion Permanently delete client knowledge base profile | Full Access | Full Access | Restricted | Disabled |
Knowledge Bundle Sections Edit section markdown, upload docs, replace template content | Full Access | Full Access | Full Access | Read-only badge |
Campaign Automations Create campaign, toggle active status, edit strategy, delete campaign | Full Access | Full Access | Full Access | Read-only message |
Campaign Generation & Recovery Generate article now, requeue failed topics, move to planned, replace live | Full Access | Full Access | Full Access | Disabled / Hidden |
Topic Cluster Planner Draft cluster plan, edit keywords & topics, approve or reject plan | Full Access | Full Access | Full Access | Read-only notice |
Article Preview & Content Hub Edit article body, refresh featured/section images, update CTA, republish | Full Access | Full Access | Full Access | Read-only viewer pill |
Article Deletion Permanently delete published or draft article | Full Access | Full Access | Restricted | Hidden |
Workspace Members & Roles Invite members, update assigned roles, remove members from workspace | Full Access | Full Access | Restricted | Restricted |
Billing & Plan Checkout Upgrade/downgrade subscription plan, manage payment methods, view invoices | Full Access | Restricted | Restricted | Restricted |
Workspace Role Profiles
Understand each role's responsibilities, boundaries, and expected usage.
Workspace Owner
The primary account holder with unrestricted authority over billing, subscriptions, integrations, team governance, and content workflows.
- ✓ Manage billing, plans & invoices
- ✓ Connect & verify CMS integrations
- ✓ Invite members & assign roles
- ✓ Full publishing & execution control
Workspace Admin
Operations leads and agency project managers who configure CMS connections, manage knowledge bases, and invite team members.
- ✓ Connect, verify & disconnect CMS
- ✓ Invite and manage Editors & Viewers
- ✓ Manage knowledge base profiles
- ✕ Cannot alter subscription or billing
Content Editor
SEO strategists and copywriters who design cluster plans, launch campaign automations, refine knowledge bundles, and edit articles.
- ✓ Draft and approve topic clusters
- ✓ Launch campaigns & trigger articles
- ✓ Edit articles & refresh AI imagery
- ✕ Cannot modify CMS or team members
Workspace Viewer
Clients, stakeholders, and external reviewers who need read-only visibility into live campaigns, generated content, and SEO roadmaps.
- ✓ Preview published and draft articles
- ✓ Inspect topic plans & schedules
- ✓ Review client knowledge bundles
- ✕ Zero write, edit, or trigger permissions
Dual-Gate Security Architecture
To maintain deterministic execution and prevent runaway costs, every mutation in Jumsom must satisfy two independent layers of verification before execution.