Every CMS integration has the same shape: an API that can create content, and a decision about whether the agent can publish it. That decision is the whole design. Once an agent can publish, it can put a wrong claim in front of customers, and no prompt instruction fixes that.
Three servers in the directory make the trade-offs concrete: Sanity, Ghost, and WordPress.
The short answer
Give the agent draft creation and editing, not publication. Review the draft where the team already reviews content, then publish as a person. Everything else — structure, links, metadata, images — can be automated without touching the live site.
Sanity: schema as the guardrail
Sanity content is typed by a schema, which changes what an agent can do. A draft either matches the schema or fails; the agent cannot invent a field. That makes it the most predictable of the three for structured content — and the least flexible for free-form writing.
The practical advice is to give the agent the schema explicitly. Without it, the model guesses at field names and produces documents that look right and are not.
Ghost: publishing is a send button
Ghost combines a blog with a newsletter, and that combination makes the risk concrete: publishing can mean emailing every subscriber. A draft in Ghost is safe; a send is not. The API does not blur that line, but a workflow that automates 'publish' will.
For a publication, the useful automation is the editing pass — metadata, internal links, alt text — not the send.
WordPress: roles as the boundary
WordPress has a twenty-year-old answer to this problem: user roles. An editor role can create and manage drafts but cannot publish. That is exactly the contract you want, and it is enforceable at the token level rather than the prompt level.
The mistake is connecting a personal administrator account because it is already there. That grants the agent more than any prompt says it should have.
What to automate
| Task | Safe | Notes |
|---|---|---|
| Draft creation | Yes | With a service user |
| Internal links | Yes | Verify they resolve |
| Meta description | Yes | From the content, dated |
| Image placement | Yes | Alt text included |
| Publish | Human | The irreversible step |
| Email send | Human | Cannot be unsent |
The first four are where an agent saves an afternoon. The last two are where it creates an incident.
The review that makes it work
Draft-first only saves time if the review is short. A five-minute review of a draft is the goal: does the piece answer its title, does it make claims we cannot support, would we sign it. If the review takes forty minutes, the agent is producing a different piece than you would write, and the automation is not working.
Frequently asked questions
Can I automate scheduled posts? For templated, low-risk content, scheduling is a reasonable middle ground. For anything with third-party claims, review wins.
What about revisions? WordPress stores them by default; check your other CMS. The point is that an agent edit should be as reversible as a person's.
Do I need MCP for this? No, the same contract works with a REST script. MCP matters when you want the agent to choose between drafts, media, and links in one conversation. See publishing with an agent.
Last checked: 12 November 2026.
Related: publishing with an agent, claim verification, and MCP servers.
