Three things decide what your AI assistant can do in ContentForge:
- What you allowed when you connected it or made its key: Read, Write or Publish.
- Who it acts as: always the person who connected it, with that person's role, clients and tools.
- Whose connection it is: your agency's, or one of your client people's.
All three are checked on every request. If any one says no, the request is refused with a plain reason.
Read, Write and Publish
Each level includes the ones before it.
Read (always on). Your assistant can look but not change anything:
- clients, sites, pages and a page's full content;
- blog posts, collections and their items;
- social posts and press releases;
- the widget library and the site's media library;
- reporting: Search Console, GA4, the latest map scan, tracked keywords, the latest backlink snapshot, citations, Zeus recommendations and saved competitors;
- your credit balance, prices and the progress of a run.
Write (called Change drafts at sign-in, Read + write drafts on a key). Also:
- add clients, blank sites and pages;
- edit site drafts: pages, widgets, sections, header and footer, menu, popups, theme and page SEO, with undo;
- add images to a site's media library;
- create and edit blog post drafts and hidden collection items;
- save social posts and press releases as drafts;
- update Zeus recommendations (in progress, executed, defied, steps done);
- start Zeus scans and SEO tools. These cost credits, and your assistant always tells you the cost and waits for your yes.
Publish (called Publish: put changes live on the site at sign-in, Read, write + publish on a key). Also:
- publish the whole site or one page;
- publish or schedule blog posts;
- show collection items on the site.
Without Publish, everything your assistant does stays in the draft or hidden until you publish it yourself. That's a good way to start.
How to change the level
- Signed-in apps: go to Settings → API & MCP → Connected apps (sign-in), click Disconnect, then connect again from your app and tick the new choices.
- API keys: make a new key with the level you want and revoke the old one. A key's level can't be edited.
Tool names, if your app shows them
Some apps show the tool names when they ask to use one. The Connect your AI card on Settings → API & MCP lists them under Tools at your level, by Read, Write (drafts) and Publish. Only the tools whose names start with run_ cost credits.
Your role and tool access
The connection acts as you, so:
- Owners and Admins reach every client and every tool on the plan.
- Members reach only the clients assigned to them. Other clients and their sites are "not found".
- If a tool is turned off for a Member under Settings → Team Members → Tools, the connection can't use it either. For example, without Mount Olympus it can't read or edit sites; without Zeus it can't read or update Zeus recommendations; without Map rankings it can't read map scans. The message says which tool is missing: "The person this connection acts as doesn't have access to Mount Olympus in ContentForge."
- Remove someone from the agency and all their keys and connections stop working at once.
- Owners and Admins see every team member's keys and connected apps on Settings → API & MCP, and can revoke them. They also see Recent changes made through the API: every change, which key or app made it, and whether it worked.
Credits are the agency's. Any connection with Write, from anyone whose tools allow the run, can spend them, but only after the person says yes to the cost.
Client connections
You can let a client person connect their own AI assistant to their own sites. It's off for everyone until you turn on Connect your own AI tools for that person in Client → Settings. See Client MCP access.
A client person's connection:
- only sees their own business, and only the sites they're assigned;
- only gets the tools their client permissions allow, for example:
- Editor: edit pages, the header and footer, menu, popups, the theme and page SEO; add pages; collection items;
- Widget content: change words and images in existing widgets, nothing else;
- Blog: write, edit and publish blog posts;
- Popups: make and change popups;
- SEO settings: change page SEO;
- Content Library: read, add and change collection items, and add images;
- Dynamic pages & Connect to Data: read collections and connect widgets to collection data;
- Site performance & stats: read reports, but only the ones switched on in their portal;
- Site publish or Site republish: publish the site or a page (they also need to tick Publish when they connect);
- keeps your locks: parts of a page you locked for client editing stay locked;
- can only undo its own changes;
- never gets Zeus. Zeus scans, Zeus recommendations, Ads Review and GBP Optimizer aren't in its tool list. If its app tries a Zeus run anyway, it's told "Zeus is only available to your agency";
- never spends your credits. No SEO tool runs, no credit balance;
- never gets agency-only tools: adding clients or sites, social posts, press releases and saved competitors.
Turn the permission off, or remove the person, and their connections stop at once.
When a client person connects, the sign-in page shows their business (for example "Acme Gutters — via" and your agency's name), the sites the connection reaches and what their permissions let it do.