Granular Access Control and Role-Based Permissions in KeystoneJS

When building a headless CMS on KeystoneJS, you often need to split access between editors, moderators, and admins, and hide internal notes from regular users. A typical solution is a multi-level access control system: at the operation (CRUD), item, and field level. We have helped more than 30 projects set up such models turnkey—from analysis to deployment, with security and performance guarantees. In one project for a publishing house, we needed 7 roles with different access to 15 lists. The role model via the database allowed changing permissions without restarting the server, cutting change approval time by 40%.

Why KeystoneJS Wins Over Strapi in Access Flexibility

Strapi uses rigid roles with fixed permissions, and Directus offers only three levels (public, readonly, full). KeystoneJS provides four levels—Operation, Filter, Item, Field—plus the ability to store roles in the database. This lets you implement any business rules without hardcoding. For example, we set up a system where an editor can edit only his own drafts, a moderator can publish others', and an admin can delete. The setup took 3 days, whereas on Strapi we would have had to write custom middleware, extending the timeline to 2 weeks—that's 4.5 times longer.

How to Configure Access Control for Multiple Roles in KeystoneJS

Let's break down the setup using a typical project example. First, define the lists and roles. For each role, create a record in the Role list with flag fields as shown below. Then, in the access functions of each list, check these flags. This approach is flexible and allows managing permissions through the admin panel.

KeystoneJS Access Levels: From Operations to Fields

KeystoneJS's access control is built on four levels. Each solves a specific task.

These levels are thoroughly described in the KeystoneJS Access Control Guide. Here's a combined configuration example for the Post list:

access: { operation: { query: ({ session }) => !!session, create: ({ session }) => session?.data?.role?.canManagePosts, update: ({ session }) => ['editor', 'admin'].includes(session?.data?.role), delete: ({ session }) => session?.data?.role === 'admin', }, filter: { query: ({ session }) => { if (session?.data?.role === 'admin') return true; return { author: { id: { equals: session?.data?.id } } }; }, }, item: { update: async ({ session, item }) => { if (session?.data?.role === 'admin') return true; return item.status === 'draft' && item.authorId === session?.data?.id; }, }, fields: { internalNotes: text({ access: { read: ({ session }) => session?.data?.role === 'admin', create: ({ session }) => session?.data?.role === 'admin', update: ({ session }) => session?.data?.role === 'admin', }, }), salary: integer({ access: { read: ({ session }) => ['admin', 'hr'].includes(session?.data?.role), update: ({ session }) => session?.data?.role === 'admin', }, }), }, }, 

How to Store Roles in the Database

Instead of hardcoding roles in code, store permissions in the database. This allows changing permissions via the admin panel without restarting.

Comparison of approaches:

// lists/Role.ts export const Role = list({ access: { operation: { query: allowAll, create: ({ session }) => session?.data?.role === 'admin', update: ({ session }) => session?.data?.role === 'admin', delete: ({ session }) => session?.data?.role === 'admin', }, }, fields: { name: text({ validation: { isRequired: true }, isIndexed: 'unique' }), canManagePosts: checkbox({ defaultValue: false }), canManageUsers: checkbox({ defaultValue: false }), canManageRoles: checkbox({ defaultValue: false }), canPublish: checkbox({ defaultValue: false }), users: relationship({ ref: 'User.role', many: true }), }, }); // auth.ts sessionData: 'id name email role { canManagePosts canManageUsers canPublish }', 

Usage in the Post list:

access: { operation: { create: ({ session }) => !!session?.data?.role?.canManagePosts, update: ({ session }) => !!session?.data?.role?.canManagePosts, delete: ({ session }) => !!session?.data?.role?.canManagePosts, }, }, 

How We Set Up Access: Process and Scope of Work

1. Object and role analysis — define lists, operations, fields. Output: permission matrix.
2. Design role model — create Role list with checkboxes for each permission.
3. Implement access functions — write Operation, Filter, Item, Field for each list.
4. Test scenarios — verify permissions for each role (up to 20 cases).
5. Deploy and monitor — deploy to server and monitor logs.

Common Mistakes in Access Configuration

Beginners often confuse levels—for example, using Filter Access when Item Access is needed. Filter Access works automatically at the query stage and cannot check item fields that aren't loaded yet. Item Access is suitable for checking status or authorship. Another typical mistake is forgetting to include the necessary role fields in sessionData. Without that, access functions won't see the permissions. We test all scenarios to avoid such issues.

Timelines and Cost

A typical role model setup (3–4 roles, 5–10 lists) takes 2–4 days. Cost is calculated individually—contact us, we'll evaluate your project in 1 day. Get an engineer's consultation for your project.

Experienced engineers with 5+ years of work with KeystoneJS will help implement even complex access scenarios. Contact us for a free estimate.