# Who can publish and change a website

> Project and workspace roles, API keys, connected apps, Benchy and guests, and the record of who changed what.

Canonical: https://benchy.world/docs/websites/access
Last updated: 2026-10-28

## Roles [#roles]

A website has its [project](https://benchy.world/docs/projects)’s access, and a website with no project follows [workspace](https://benchy.world/docs/workspaces) roles. In a private project, the workspace’s Owner still manages the website’s domains and billing and can delete it, but can’t change what it shows. Moving a project to the Trash takes its websites offline, and purging the project deletes them.

| Role | What they can do |
| --- | --- |
| Can view | See the website, its versions, previews and domains, and its history through the CLI or an agent |
| Can edit | Also publish previews and live versions, roll back, take it offline, connect and remove domains, edit content, read and export form entries |
| Workspace Owner | Also permanently delete it in Studio |

A website with no project joins a project when a canvas from that project is published to it. That happens only when nobody loses it: if it’s a draft you made, the project is open to the workspace, or you’re the workspace’s Owner.

A [guest](https://benchy.world/docs/members-and-guests) on a project works on its websites at their project role, except domains and form entries, which are for members. Guests on a chat, canvas or doc don’t see websites in Studio; like anyone, they can open an address you share.

## API keys and connected apps [#keys-and-apps]

A key or connected app reaches the one workspace it was made for, never doing more than its person could. See [Connect your agent](https://benchy.world/docs/connect-your-agent).

| Access | What it can do with websites |
| --- | --- |
| Read | See websites and their versions |
| Publish websites | Create a website, and publish, preview, roll back and take it offline. It can’t connect a domain, change content, read form entries or publish a canvas. Limit it to one website and it sees only that one, and reserves no new names |
| Read and write, Ask me each time, or a connected app | Everything a person with Can edit can do through the tools, except deleting. With Ask me each time, every change waits for your approval in Studio |

- For the CLI, a build script or CI, use a **Publish websites** key limited to one website, so a leaked key can only publish that website.
- Revoking a key or disconnecting an app stops it at once, mid-deploy included.
- No key or app can delete a website; the workspace’s Owner does that in Studio.

## Benchy [#benchy]

Benchy acts with the role of the person who asked. The one change it makes to a website is publishing the canvas the chat is open on, to a website that already exists. Every publish, preview or live, asks first on a card naming the website and address, and “Always allow in this chat” never covers it. Rolling back, taking a website offline, changing content and connecting domains are yours.

## Who did what [#history]

A website’s history records every deploy, rollback, offline switch, domain change and content save with the person and what it came through: Studio, the CLI, a named key, a connected app, or Benchy on their behalf. Read it with `benchy site get` or by asking your agent. See [Versions and history](https://benchy.world/docs/websites/publish#versions).