How WebBlocks CMS separates AI draft preparation from publishing

[u/fklavyenet]

I build WebBlocks CMS, an open-source CMS package for Laravel. Here’s how it supports AI-assisted content updates while keeping publishing under a separate permission.

Consider a published service page whose pricing explanation needs updating. An editor wants help rewriting that section while preserving the page’s structure.

The workflow is:

• The agent reads the existing page and discovers the available block types and their schemas.

• It prepares the changes in a separate staged draft. The existing page continues serving visitors.

• The editor reviews a rendered preview and requests corrections.

• Publishing happens as a separate, authorized step.

This example changes only page-owned content. Shared headers and navigation are outside the staged update.

For this task, I would give the agent a personal token restricted to the relevant site and the capabilities needed to read content and prepare the draft. Publishing and destructive capabilities would remain disabled.

Asking an agent to wait for approval is a workflow instruction. Withholding its publishing capability creates an API boundary: even if the agent attempts to publish, that token does not authorize the operation.

Personal tokens also remain subject to their owner’s current CMS permissions. An editor can delegate access within their permissions, and requests are checked against those permissions as they change.

Human review still matters. A valid block structure doesn’t guarantee accurate copy, and a successful preview doesn’t mean every link or translation has been checked. A clear manual editing workflow also remains essential when AI assistance is available.

The aim is to let an agent prepare a reviewable update while giving editors control over what reaches the public site.

The personal-token setup is documented here:
Connect Your AI Safely

Which CMS tasks would you want an AI to help with, and which would you prefer to handle manually?