# Admin handbook

Administrators manage writers, saved content organization, reader settings and local publication. These controls affect your self-hosted editor instance, not a public writing service at markstack.app.

# Give writers the narrow access they need

Accounts and sessions covers account creation, roles, section assignments, resets and session effects. Verify the intended role with a separate writer session and synthetic content. Public-reader protection is a separate hosting decision.

Changes to role/access/password can end sessions. Coordinate with writers so they can preserve local unsaved work, then require fresh sign-in and a role-specific access check. Do not infer success from an administrator’s broad access.

# Organize saved source and planned routes

Sections and pages covers section metadata, access tabs, folder changes and the page catalog. A title change can change public routes. A hidden section still builds and can appear in search.

Catalog routes are planned from saved source; actual live output changes after build/deployment. Inspect the exact source/path and old public URLs before retiring content. The console is not a general undo or source-history service.

# Change reader settings safely

Settings and header links explains validated settings, unsaved state and link targets. Saving configuration is not publishing/deploying it. Custom HTML/script decisions carry security consequences and need actual source/output review.

Keep public identity and destinations intentional. Check links in the generated header and deployed reader, including narrow widths. A setting value accepted by the form is not proof an external destination is correct or private.

# Inspect policy and bounded history

Security and history explains policy summaries, passwords, audit filters, retention and publish history. Recognized secret patterns are redacted, but copied diagnostics still need inspection. Logs do not provide tamper-proof/unlimited evidence. Inspect real affected state before repeating an action because a record is absent.

# Publish a reviewed saved snapshot

The shared publisher builds saved content from all intended writers, verifies output and switches local reader files. It does not automatically commit, push or deploy remotely. Use Save, publish and deploy for state checks and failure diagnosis.

Before inviting a team, finish the environment’s TLS, host/proxy, service-permission, backup and restore checks in Run. A successful browser login is one check, not a production-operation assessment.