# What your clients can change

After this page you know what a client can change on their own, what waits for your approval, and how to set that per client.

## The four steps

Every client has a step. You choose it when you invite them, and change it under **Settings › Access** on the site's page.

| Step | What the client may change |
|---|---|
| **Text and images** | Words and pictures on existing pages. The default. |
| **Blocks and pages** | Also add, move and remove blocks, and add pages. |
| **Design** | Also colours, fonts, spacing and other styling. |
| **Everything** | Anything that is not protected. |

## Above their step: your approval

A client can still ask for more. When a change goes above their step, they can still save it, but publishing waits: you get an email with a picture of before and after, and choose **Approve**, **Reject** with a note for the client, or **I'll finish it myself**. Nothing above their step goes live without you. See [Approvals](/docs/approvals).

## Protected by default

Whatever the step, some parts are protected: what makes the site work rather than what it says.

- `admin.json`, always.
- Everything outside the site's own folders. Per kind of site, these are open:

| Kind of site | Open folders |
|---|---|
| astro | `src/`, `public/` |
| next | `app/`, `pages/`, `components/`, `src/`, `public/`, `styles/`, `content/`, `data/` |
| react-router | `app/`, `public/` |
| nuxt | `app/`, `pages/`, `components/`, `layouts/`, `content/`, `assets/`, `public/` |
| sveltekit | `src/`, `static/` |
| gatsby | `src/`, `static/`, `content/` |
| react-scripts | `src/`, `public/` |
| vite | `src/`, `public/` |
| vite-react | `src/`, `public/` |
| vite-vue | `src/`, `public/` |
| vite-svelte | `src/`, `public/` |
| eleventy | `src/`, `content/`, `_includes/`, `_data/` |
| docusaurus | `docs/`, `blog/`, `src/`, `static/`, `i18n/` |
| vitepress | `docs/`, `public/` |
| hugo | `content/`, `layouts/`, `static/`, `assets/`, `data/`, `i18n/` |
| plain HTML | the whole site |

- In code (a component, a page with logic), a client may change the text and the styling, never the code itself. Adding a script, an `on…=` handler, a `javascript:` link or an embedded frame is refused.
- An existing page cannot be removed or renamed by a client, so no link to it breaks.

Change this per site with `protected` and `open` in [admin.json](/docs/admin-json).

## How it is enforced

Every change is checked when it is saved and again when it is published, on the change itself, not on what the assistant says it did. A change that is not allowed never reaches `main`.