Scopes and organization controls

Areas (scopes)

Each area has a read scope and a write scope, for example cms:read and cms:write. Write includes read.

site: website builder (pages, blocks, styles, components and layouts, SEO, forms and analytics reads, publishing).

cms: CMS collections and entries, versions and relations.

commerce: products, variants, offers, collections, inventory, discounts, orders, customers and sales analytics.

code: code components and Code Builder projects.

design: the Studio (Praisma editor): posters, images, animation and video export.

media: the media library: find, upload, generate images, remove backgrounds.

social: social post drafts and their visuals, the social inbox (comments and direct messages) and social analytics.

campaign: AI campaigns: plans, briefs, budgets, deliverables and metrics.

brand: brand kits.

workspace: workspace skills (your saved how-tos and rules).

A scope never overrides your role. For example, commerce:read shows orders only if your role may view orders.

Organization controls

Administrators set what assistants may do in an organization under Settings → AI connectors → Organization controls. There are three modes:

Full: everything each person approves when connecting.

Read only: assistants can read, but never change anything.

Custom: each area is set to off, read or write. An area that is not listed is off.

Controls apply immediately to every existing connection: nobody needs to reconnect, and loosening the controls later restores what people had approved. Blocked tools disappear from the tool list. If an assistant calls one anyway, it gets a clear message that the organization's administrator has limited AI connectors. The built-in guides stay available in every mode.

Everyone can see the current controls. Only the workspace owner or someone with permission to manage integrations can change them, and every change is recorded.

Organization controls apply to external connectors only. Praisma's in-app assistants run in your own session and ask for confirmation instead.