Large organization
This is an infrastructure pattern, not an Enterprise edition, capacity promise or compliance certification. Separate writing, review, artifact delivery and reader access.
Topology
flowchart TD Writers[Section writers] --> Source[Private editor or Git source] Source --> Review[Review saved source] Review --> Build[Isolated V2 build] Build --> Host[Static reader host] Host --> Readers[Authorized readers]
Arrows describe your agreed workflow. Save does not submit review automatically. Editor Publish does not deploy to the external host. Host controls protect readers; section accounts protect editing.
| Layer | Responsible mechanism |
|---|---|
| Source ownership | Grants and team process |
| Approval | External review/release process |
| Identity | Local accounts plus external gate if needed |
| Reader privacy | Host/network gate on all output |
| Delivery scale | Static host/CDN configuration |
| Writer availability | One supervised process and recovery |
| Compliance records | Controlled evidence/retention system |
Department boundaries
Use clearly scoped physical section roots and a small administrator group. Assignment is top-level section access, not arbitrary document ACLs or role hierarchy. Administrators retain global writing capability.
Record who approves root/cross-section changes, shared settings/links, routes and assets. Compare actual grants/accounts with that plan. Department labels or custom frontmatter do not enforce policy.
Release provenance
Preserve reviewed source revision, engine pin, lockfile, relevant config/runtime snapshot, built artifact and deployment result. State what the release includes and its prior-artifact recovery path. A path/size/time fingerprint is not content-integrity evidence or approval.
Save/Publish does not create Git review. Bounded local activity history is not immutable compliance storage. Dates and checkboxes are not certifications.
Measure representative content
| Measure | Record |
|---|---|
| Corpus | Pages/headings, long tables, real media |
| Builder | Node, duration, memory and failures |
| Artifact | Total bytes and search JSON size |
| Search | First fetch/preparation and queries |
| Devices | Slow target phone and desktop |
| Writer | Saves/catalog/file operations/Publish |
| Recovery | Restored source/runtime and reader tasks |
Use actual content and network. A small local build cannot establish maximum pages, unlimited traffic or guaranteed latency. CDN delivery does not change single-process editor state, concurrent-save limits or account storage.
Identity and operations
Evaluate required MFA/SSO at the approved external boundary. Check no unprotected direct writer listener or asset path bypasses it. Test exact forwarding addresses, TLS/cookies/host/session behavior.
Keep private backups, OS permissions, monitoring and retention outside app limits. Do not upload accounts/logs/source history/internal downloads publicly. Protect reader HTML, search, media and download bytes.
Independently hosted readers can continue while editor stops. That is an architecture choice, not writer HA. Rehearse writer restore and reader-host rollback with responsible owners. If realtime collaboration, distributed writers, federated identity or certified records are mandatory, state the unmet requirement and evaluate other tooling.