Let the client edit their own website – without breaking it

The two usual answers fail in opposite directions. Give the client nothing and every phone number in the footer becomes an email to you. Give the client a full CMS and they get enough rope to wreck the design your name is on. What is missing is a ceiling: an editing surface where the content is open and the structure is locked.

A ceiling is not the same thing as a limited role in an ordinary CMS. A role hides buttons in the interface; a ceiling has to hold in the data model, otherwise it is a courtesy rather than a constraint. In SnabbSajt a section's content is a typed union and the theme is pre-validated tokens – there is simply no way in for raw HTML or a hand-picked hex colour, regardless of who is logged in.

The client owns the words and the pictures: headings, body copy, button labels, prices, images and alt text, contact details, opening hours, services. That covers nearly every edit that would otherwise have become an email to you, and it is the kind of change you did not want to review anyway.

The client does not own typography, the colour scale, the composition your layout depends on, or the underlying code. Editing also happens against a draft – the published site is an immutable snapshot, so no half-finished sentence sits live while the client is still thinking.

You build the site the normal way, in your stack: your Next.js code, your components, your repo, your CI. The build is then converted into a validated site package and sent in with `snabbsajt push`. What crosses the boundary is content and structure – never executable code. We do not run imported React, PHP, plugins or arbitrary CSS, for exactly the reason the ceiling exists.

A second push into a site the client has already edited is a merge, not an overwrite. Sections match on a key, the client's edits are reported as conflicts and kept, and `--dry-run` shows the whole merge before anything is written. A push never publishes.

The structural ceiling is the same for everyone, but the surfaces are not. In settings, the workspace owner can switch off whole areas for their client – or individual features inside an area – and there is a mode that hands over an account where the client may edit and publish the website and nothing else. The check lives in the backend, so a disabled feature is refused even when something calls it directly.

The client can connect Claude to their site through our MCP server and ask for the change instead of hunting for the field: "add a block about our new service". It goes through the same constraints as the interface – the agent works on the draft, reaches only the surfaces the client reaches, and never publishes unless a human says so.

Count last year rather than guessing: how many content emails came in, and how many of them did you actually bill? The answer is the whole argument. A client who can change a phone number themselves does not call, and a site that keeps up with the business does not get rebuilt by someone else in three years.