AEM Content Governance: Roles, Workflows and Multisite

A site on Adobe Experience Manager (AEM) rarely gets messy because of the technology. It gets messy because nobody decided who creates, who approves and who retires content. Every department asked for its own template, the Colombia site no longer looks like the Mexico one, legal approvals live in email and a two-year-old promotion is still live. With three sites you can get by; with fifteen in four languages, every global change turns into a project.

At WolfSellers we implement and run Adobe Experience Manager Sites for companies with multiple sites, brands and countries. What AEM Sites is and how its architecture options compare is covered in our AEM Sites guide. This article is about governance: roles, approvals, templates, multisite and translation, structured content, the operating model, author training and metrics, on AEM as a Cloud Service. What we say about Adobe features comes from its Experience League documentation, reviewed in October 2026.

---

What content governance in AEM is

Content governance is the set of rules, roles and controls that decide who can create, approve, publish, reuse and retire content, with which templates and on what timelines. In AEM those rules don't stay in a document: they're enforced through permissions, workflows, templates, component policies and the Multi Site Manager (MSM) configuration. It's the content-side counterpart of data governance in Adobe Experience Platform.

Signs your AEM lacks governance:

1. Inconsistent templates: dozens of near-duplicates and nobody knows which one to use.
2. Pages without an owner: nobody answers for them when they need updating or removing.
3. Approvals by email: brand or legal review happens outside AEM and leaves no record.
4. Country sites drifting apart: a global change never reaches the countries, or it does and wipes out local content.
5. Outdated content still live: expired promotions, old prices, stale legal notices.

Roles and permissions in AEM: who can do what

In AEM as a Cloud Service, access starts in Adobe Admin Console, with Adobe Identity Management System (IMS). The author and publish services of each environment (production, stage or development) are assigned through product profiles: the administrators profile grants admin privileges in AEM and the users profile, regular access. You can connect your SAML 2–compliant identity provider for single sign-on and sync users from Active Directory with the User Sync Tool, one way only.

Fine-grained permissions are still managed inside AEM: groups synced from IMS are added to local groups that hold the privileges and access control lists (ACLs) per path. Some capabilities depend on specific groups: template-authors creates templates, experience-fragments-editors writes Experience Fragments, tag-administrators changes the taxonomy, and launches require access to /content/launches, like the access the content-authors group has.

Adobe recommends defining with Repo Init —scripts that live in the project code and deploy with it— the groups that are part of the application, such as the group a workflow assigns an approval to, and managing purely organizational groups at runtime. That keeps them under version control instead of hand-configured in each environment. We apply least privilege: permissions by group and by site branch, never to individuals; publishing is an explicit permission, and the administrator list is reviewed every quarter.

RACI matrix for AEM Sites

R = responsible, A = accountable, C = consulted, I = informed. It's our starting point, not an Adobe standard.

Approval and publishing workflows in AEM

Workflows: review before publishing

An AEM workflow automates a series of steps on pages or assets and notifies each participant when it's their turn. Adobe's example: the author applies the workflow, an editor gets a task to review the page and, once that's done, the site administrator gets a task to publish it. Tasks land in each participant's Inbox. Two details worth designing from day one:

• Publishing without permission triggers a request. If an author doesn't have the privileges to publish a page, trying to do so triggers a workflow that notifies the right person. It's the simplest way to route every publication through an approver.
• Quick Publish also publishes unpublished references. Manage Publication, by contrast, lets you review them, include child pages, choose the destination and schedule.

We recommend a few workflow models —one for low-risk fixes and one with brand or legal review— rather than one per department.

Scheduled publishing and Launches

With Manage Publication you can publish or unpublish at a future date (which starts a workflow you can cancel from the workflow console) and, if you have a preview service configured, publish there before production. To temporarily hide content that's already live without unpublishing it, Adobe suggests On Time and Off Time in page properties.

For big, dated changes —a season, Black Friday or Mexico's El Buen Fin, a relaunch— there are Launches: a copy of the pages where you prepare the future version while the current one stays live. When the date arrives you promote the launch and publish; if you flag it Production Ready and set a date, AEM promotes and publishes it automatically. Adobe warns that a launch of the whole site can be impractical with hundreds or thousands of pages: do it by branch.

Versions and audit log

A version is a snapshot of a page: you can restore it, recover deleted pages, roll back an entire tree to a date and compare. Only content is versioned; code, CSS and JavaScript are not.

Retention is configurable. In AEM as a Cloud Service, version purge and audit log purge (replication, page and DAM logs) aren't enabled by default today, but Adobe says that will change: for environments created afterward, the defaults remove versions older than 30 days —keeping the five most recent within that window— and audit logs older than 7 days. If your industry requires uneditable audit logs, Adobe recommends integrating a specialized external service. Set retention with legal and compliance, not by default.

How to limit what an author can break: templates, policies and components

When authors create a page, they pick a template that defines its structure, its initial content and the components they can use. With the Template Editor, a template author —a power user in the template-authors group— creates and maintains templates without development, once developers have built the components.

Three Adobe rules we treat as the baseline: a new template starts as a draft and isn't available until you enable it; if you edit one that's already enabled, AEM warns that the change may affect the pages using it; and Adobe suggests staying under 100 templates and doesn't recommend going over 1,000.

Core Components are Adobe's 30 standard components; their template-level policies define which features authors can use, and Adobe states they comply with WCAG 2.1, with documented known issues. Starting from them reduces what you have to govern; for new projects, though, Adobe recommends Edge Delivery Services (more on what changes below). And before approving a new component, we check whether a style or a policy would do.

How to govern multiple sites and languages with MSM and translation

Multi Site Manager (MSM) reuses one site's content in others through live copies, copies that keep a live relationship with their source (the blueprint). Rollout configurations define when and what gets synchronized; authors can suspend inheritance for a page or cancel it for a component to customize it, and Detach breaks the relationship permanently.

Adobe's MSM best practices are, at heart, governance practices: plan structure and content flows before implementing, customize as little as possible, establish a governance model early and train users accordingly, and limit local content producers' authority to connect content to other live copies, because ungoverned chained inheritance makes the structure complex and fragile. Three behaviors every author needs to know:

1. With the standard configuration, deleting a page in the blueprint deletes it in the live copies; moving it doesn't move them.
2. On rollout, a component is replaced as a whole: anything a country added inside it is lost, unless the component is declared a container.
3. Pages a country creates inside its live copy are not synchronized with the source.

Translation: language copies or live copies

MSM doesn't translate. That's the job of the Translation Integration Framework, which connects to human or machine translation providers and works with language copies. Adobe recommends language copies to get started and reserves MSM for large, complex sites, which need strong governance and automation to avoid overwriting translations. It also asks you to decide up front whether content is authored centrally and pushed or pulled to countries, what each country can unlock and who manages translations. AEM can also use a large language model as a translation service —starting with Azure OpenAI, under your own license— with per-locale rules generated from your style guides.

Typical setup: Mexico, Latin America and North America

Adobe recommends a language-based structure, with no more than three levels between top-level authoring and country sites, and a layer of language masters —pages that aren't published— where translations are reviewed before being passed, through MSM, to the countries that share the language. For a brand headquartered in Mexico: a Spanish master, with es-MX, es-CO and es-PE as live copies, and an English master translated from it, with en-US and en-CA. What's inherited and what's local:

Structured content and taxonomy: fragments and tags

Content Fragments are page-independent editorial content, with a structure defined by a model, ready for pages and headless delivery. Authors can't change the structure while editing, and the model validates: required fields, regular expressions, unique values per language root, minimum and maximum number of items, and the type or size of referenced assets. Adobe recommends as many models as needed and no more —a few dozen at most is usually enough; too many complicate governance—, no more than ten nesting levels and no more than ten variations per fragment.

Experience Fragments are a piece of a page, with content and layout, reused across pages instead of copying and pasting, and they work with MSM. A Content Fragment is content without design; an Experience Fragment is content that's already laid out.

Tags are grouped in namespaces, and their taxonomies are global across AEM: they apply to pages and to asset metadata. Only tag-administrators, or users with modify rights on /content/cq:tags, can change the taxonomy. Tags are published like pages and can be merged; Adobe advises against having two tags for the same idea. We cover image and document metadata in our Adobe DAM guide.

How Universal Editor and Edge Delivery Services change governance

The Universal Editor is AEM Sites' visual editor for headless or traditional experiences, and Adobe says it intends to eventually supersede the Page Editor. Its listed features include access control, versioning, approval and publishing workflows inside the editor, and MSM inheritance. It's supported on AEM as a Cloud Service and AEM 6.5, including the LTS release.

Edge Delivery Services replaces AEM's publish tier and Dispatcher and the Core Components way of building; site code lives in GitHub. It supports two authoring approaches, and governance moves depending on which one you use:

With document-based authoring, the aem.live documentation is explicit: by default, authors don't need to sign in to use AEM through Sidekick. Authentication kicks in once you declare roles in the site configuration, per user or per domain: the author role previews and the publish role publishes. If you choose this model, that's the first thing we configure. We cover the speed side in how to optimize AEM performance.

The operating model: editorial board, style guide and content lifecycle

The platform enforces the rules; someone has to write and review them:

1. Editorial board: content owners by department and country, brand, legal, the AEM administrator and a technical lead. Every month it approves new templates and components, taxonomy changes and MSM inheritance exceptions.
2. Style and component usage guide: tone, terminology and which component to use for what; it also feeds AI translation, if you use it.
3. Publishing SLA: how long an approval takes by content type; for example, one business day for fixes and one week for new pages with legal review. Your business sets the timelines; what matters is measuring them.
4. Owner per section: every branch of the site has a named owner.
5. Lifecycle: request (if planning lives in Adobe Workfront, that's where the brief starts, as we describe in Workfront for marketing operations), creation, approval, publishing, review every 6 or 12 months depending on content type, and retirement: unpublish, redirect the URL if it had traffic, and archive. Hiding a page with Off Time isn't retiring it.

Training and author adoption in AEM

Adobe includes training in its MSM best practices. We organize it by role:

We start from Experience League's Quick Start Guide to Authoring and turn it into a manual with screenshots of your templates. Nobody gets write permissions without the workshop, and it's repeated when templates or processes change. To measure adoption we track monthly active authors and how many pages go through approval versus being published directly.

Content governance metrics

These are our recommendations, not market benchmarks; they come from workflows, page properties and a custom report.

Common AEM governance mistakes

1. Granting admin rights to "unblock" someone and never revoking them.
2. One template per department or campaign, until nobody knows which one to use.
3. Ungoverned chained live copies and cancelled inheritance with no record.
4. Using Detach to get out of a rollout conflict: it can't be undone.
5. Approvals outside AEM, with the record stuck in email.
6. Treating AEM's audit log as regulatory evidence without setting its retention.
7. Leaving Sidekick without roles in document-based authoring.

How we do it at WolfSellers

We start with an assessment of your AEM: sites, templates, components, live copies, permissions, workflows, taxonomy and how each team works today. We facilitate the governance workshop and deliver the roles matrix, the inheritance and translation model, the template and component catalog, the publishing SLA and the style guide. Then we implement it —permissions in Repo Init, workflows, policies, blueprints and translation—, train by role and run it with you. We're an Adobe Solution Partner at the Gold level, with a 135-person team working nearshore from Mexico City.

Our Adobe Experience Manager Sites, Adobe Experience Manager and AEM Assets services cover everything from design to operations, and our support and maintenance service includes 24/7 coverage on the Business and Enterprise plans. If you'd like to review your case, contact us.

---

Frequently asked questions about AEM content governance

What is content governance in AEM?

It's the set of rules, roles and controls that decide who creates, approves, publishes, reuses and retires content in Adobe Experience Manager. It's enforced through permissions, workflows, editable templates, component policies and Multi Site Manager, and sustained by an editorial board and training.

What's the difference between MSM and language copies?

MSM reuses content across sites with live copies that inherit from a source; it doesn't translate. Language copies are the Translation Integration Framework's approach to translation. Adobe suggests combining them: translate the language masters and create country sites as live copies of them.

How do I stop authors from breaking the site design?

With templates whose structure is locked, policies that limit the allowed components and the Style System, so authors pick visual variants from a list. Put reusable content in Content Fragments or Experience Fragments.

How do you set up an approval workflow in AEM?

You define a workflow model with steps assigned to groups —for example, brand review and then publishing— and give publish permission only to approvers. When an author without that permission tries to publish, AEM triggers a workflow that notifies the right person.

How long does AEM keep versions and audit logs?

It depends on the purge configuration. It isn't enabled by default in AEM as a Cloud Service today, but Adobe announces defaults of 30 days for versions and 7 for audit logs in environments created after the change. For regulatory requirements, it recommends an external service.

How should AEM authors be trained?

By role and on your own templates: authors, approvers, country site authors and template authors need different things. Nobody gets write permissions without the workshop, and it's repeated when templates or processes change.

Does Edge Delivery Services change governance?

It depends on how you author. With AEM and the Universal Editor you keep AEM's permissions and workflows. With document-based authoring, editing depends on SharePoint or Google Drive, and publishing on roles you have to configure.

Related services

If this topic is relevant to your business, these services from WolfSellers can help you implement it:

• Adobe Experience Manager
• Adobe Experience Platform
• AI & Automation