Scoping access precisely
Granular access control
A Site role defines what someone can do in Webflow — design, edit content, review work, and so on. Granular access controls narrow that further by deciding where those permissions apply.
For example, someone might have the Content Editor role, but only be allowed to edit one CMS Collection. Or they might have the Marketer role, but only be able to work on a specific set of pages.
Role
What someone can do
Roles control the actions available to someone, like designing pages, editing content, reviewing work, or publishing.
Example: A Content Editor can update text, images, and CMS content.
Access control
Where they can do it
Access control limits those permissions to specific parts of the site, like pages, CMS Collections, or locales.
Example: That Content Editor might only be able to work in the Blog Collection.
.png)
What you can scope access to
Beyond deciding who can see a site at all, granular access lets you narrow someone's reach further along three dimensions:
Pages
Limit someone to editing specific static pages instead of the whole site.
Example: Give a legal teammate access to the Terms page, but not your marketing pages.
CMS Collections
Limit someone to specific CMS Collections so they can manage only the content they own.
Example: Give a content writer access to the Blog Collection, but not Jobs or Case Studies.
Locales
Limit someone to a specific locale so they can edit content for only that language or region.
Example: Give a regional marketer access to the German locale, but not English or French.
You can combine these controls. For example, a regional marketer could be limited to one locale, one CMS Collection, and a specific set of pages.
Common patterns worth knowing
A few scoping patterns come up often enough that they're worth knowing before you set up your own:
- A product marketer who should only add new product releases: Content Editor role, access restricted to just the Product Updates collection
- A regional team that should only work in their own language: Content Editor role, access restricted to their region's locale
- An HR team member who only manages job listings: Content Editor role, access restricted to just the Job Listings collection
Notice the pattern: The role stays the same, Content Editor, in every example. What changes is where that role is allowed to act.
A few things to keep in mind
- Access controls don’t replace roles. They narrow the permissions a role already gives someone.
- The three controls are independent. Restricting a page doesn’t automatically restrict a CMS Collection or locale, and vice versa.
- Publishing is controlled separately. Someone may be restricted from editing a page but still have publishing permissions based on their role. Custom roles are where you control publishing more precisely.
Ready to continue?
You now know what granular access control scopes and why it's a different lever than a role. In the next lesson, we'll see this paired with both a default role and a custom role.