GEO-128·Issue 11·Technical Foundation·128 / 132
Permissions, Review, and Versioning: Content Governance at Scale
Past a hundred pages, AI accuracy is an engineering problem: three field tiers, routed review, versioned releases, and a rollback drill that can fail.
Issue focusScale It: SOPs, Organization, and the 2027 Roadmap
Nine days before Black Friday, a US DTC pet-hydration brand selling into Germany gets a return request it cannot answer. Support cites 14 days; the shopper replies with a chat-assistant screenshot saying 30. In August a local operator had cut the window from 30 to 14 days to trim promotional returns, saved it in the CMS, and published. No second reader. Version history stops at a September migration; the audit log shows one login shared by five people. Composite scene.
Past a hundred pages, whether AI describes your brand correctly is no longer an editorial question but three engineering ones: who may write this field, who reviews the change, and whether you can put the last good version back.
Content became an interface; permissions stayed at two levels
A product page now has four readers: a crawler, an assistant’s retrieval layer, a marketplace feed, a comparison agent checking stock. One edit, four downstream consumers; most workflows cover only the first.
Permissions have the same gap. Two roles, editor and admin; admin can change price, warranty, certifications, templates, redirects, and robots.txt in one click. A typo fix and a return-window change carry identical rights. Shared logins are worse: the log proves only that someone did it.
Lock everything and ops batches requests; unlock everything and prices become random numbers. Cut by blast radius: what happens, and to whom, when the field is wrong.
| Tier | Fields | Who writes | Review |
|---|---|---|---|
| Locked | Price, stock, shipping, return window, warranty | Master-data owner, one writable place | Second person required |
| Controlled | Titles, answer units, comparison verdicts, FAQ, policy | Editor | Sampled |
| Free | Captions, blog paragraphs, case stories, anchor text | Writer | None |
The test is how fast the error surfaces and who absorbs it: a wrong price lets an agent order the same day, a wrong caption hurts nobody. Locked fields also need one write path — page, feed, and structured data from one SKU record — or you govern three systems, as in the GEO data pipeline.
Review is routing, not one more signature
The default is a chain everyone passes through: writer, editor, manager, marketing. It fails the week before a promotion, when nobody wants to approve an urgent correction, so the operator routes around it or leaves the error live.
Routing works better: the path depends on the field. Locked fields wake a second named reviewer, controlled fields stop at the editor, free fields move. A short path is one people follow.
Keep a reverse channel: support, a local operator, or the warehouse can flag a page or take it down, explaining afterward. Without a no-blame rule it dies after first use.
Routing decides who may change a field; a checklist decides whether the copy is good. The checklist half is the content QA gate.
A version has to answer which copy the crawler took
Versioning is not archiving; it aligns two clocks, and AI sampling lags. When an answer quotes a stale value, three questions decide the repair: which page version it came from, when the change went live, and whether the feed and cache were pushed after it.
A release record needs four fields: version, publish time, locked fields changed, downstream actions — feed repush, sitemap lastmod, cache purge, a note to support.
Counter-example: returns_policy_final_v2_FINAL.md. Three months later nobody knows which file is live, and rollback becomes a guess between filenames.
Five steps, in order
Order matters: fields before permissions, versions before rollback.
| Step | Action | Owner | Passes when |
|---|---|---|---|
| 1 Split fields | Sort page fields into three tiers by who gets hurt, one owner each | Content, platform | No field is unowned |
| 2 Narrow access | Retire shared logins; two accounts write locked fields | Platform, IT | An editor tries to change a price and cannot |
| 3 Set routing | Approval paths per tier, plus the take-down channel | Content lead | Ten sampled changes: every locked one has a second name |
| 4 Record versions | Version, time, fields changed, downstream actions | Platform | Any past date can be reconstructed |
| 5 Rehearse rollback | Quarterly: break a locked field, roll back, time the downstream | Engineering, support | Restored in one business day (Example) |
Step 5 is the one nobody runs and the only falsifiable one: without it you do not know how long rollback takes, or whether the feed follows the page.
Example: a return window that moved
Example — site, dates, and versions are invented; only the record’s shape is real.
Release record, 2026-08-14, v41: field “DE return window”, 30 days to 14. Author: local operator. Reviewer: empty. Downstream: feed not repushed, cache not purged.
In November the answers still say 30 days. Three explanations survive: the sample came from the old page, the platform still serves the old feed, or a review site quotes the old number. Each needs a different fix, and only the record tells them apart.
The repair is more than an edit: restore 30 days, cut a new version, repush the feed, correct the pages that carried 14. Then re-sample the same prompts three times, a week apart (Example cadence), against your baseline definition, or a fix looks like ordinary churn — see the AI visibility baseline.
Where content governance breaks
A small team. Two or three people do not need four signatures: locked fields, one reviewer, and git history cover the same risk, and every extra signature slows the next correction.
Marketplace listings. You inherit the platform’s permissions; you control accounts and feed access.
Rollback is not answer rollback. A restored page does not recall an answer already quoted; it shortens the error window, which is why correction and re-sampling travel together.
Statutory review. Medical devices, children’s toys, air freight with batteries: your workflow proves a signature, not that the claim is lawful.
Do not start with governance. Get visibility and answer assets working along the 90-day GEO roadmap first, then lock them. This line sits under technical foundations; it stops regressions, it does not create growth.
This month, move the return window and the warranty period from “anyone with an account” to two named accounts, and stamp the next change with a version. When a stale value surfaces, you should be able to say in ten minutes which version it came from and who changed it. If you cannot, the model was never the problem.