A CMS for agencies that run many client sites
Agencies need one place to run many client sites without mixing their content or access. HelmCMS is built around that: organizations hold workspaces, workspaces hold sites, and every level has its own members and roles.
By the HelmCMS team · Reviewed against the HelmCMS codebase on October 29, 2026
Organizations, workspaces and sites
Most CMSs were built for one company and one site, and add multi-tenancy later as a filter on top. In HelmCMS the hierarchy is the data model itself, and every request is checked against it on the server:
- Organization: your agency, with its owners and agency-wide admins.
- Workspace: one client, or one team. Its members see only its sites.
- Site: one website or app, with its own content models, media library, API keys, webhooks and allowed origins.
A resource from another tenant is answered as “not found”, not “forbidden”, so a user of one client cannot even confirm that another client's content exists.
Roles at every level
Membership can be given on the organization, a workspace or a single site. A role on a higher level applies to everything below it, and the highest role along the chain counts.
| Role | Can do | Typical person |
|---|---|---|
| Viewer | Read content, media and models | Client stakeholder who wants to look |
| Author | Create and edit drafts, upload media | Copywriter, or an AI agent |
| Editor | Everything an author can, plus publish, unpublish and delete | Client's content lead, account manager |
| Admin | Change content models, site settings, API keys, webhooks and members | Agency developer or project lead |
| Owner | Everything, including deleting the organization | Agency founder |
Nobody can grant a role higher than their own, and removing a member also cancels the invitations they had sent.
Letting AI agents work on client sites
Agents sign in over OAuth as a user, so they get exactly that user's access on exactly the sites that user can reach. A sensible agency setup:
- Create a user for the agent and add it as an author on the client's workspace.
- Connect it from your AI assistant and grant only the read and write scopes.
- Let the agent draft and update pages; your editors publish after review.
Every write and publish action is in the site's audit log with the actor, so you can always show a client who changed what.
Client handoff
Invite the client by link with the role they should have, at the workspace level for a whole client or at the site level for one property. Links expire and can be revoked. When the engagement ends, remove the agency's members from that workspace and the client keeps their content.