LinkedIn · Thu 10:00Three things we learned running our launch calendar on one desk.Home / Security
Safe to hand the keys to a team.
The controls that keep a shared publishing desk safe, each one tested against the staging service.
Four eyesOrg isolationServer-side tokens
AREditor asked for approval · version 3
LinkedIn · Thu 10:00Three things we learned running our launch calendar on one desk.ApproveRequest changesReject
✕ The editor cannot approve their own request
Two-person approval
Requesting and approving are different people. Self-approval is refused with an error, and a decided approval cannot be changed.
Approval matches the version
Publishing checks that the approval belongs to the current text and media; edits need a fresh approval.
Organisation isolation
Every record belongs to one organisation. Reading or writing another organisation’s data is refused, and the server decides who you are, not the browser.
Server-side credentials
Platform tokens stay in the server-side vault. Account checks return what an account may do, never the token.
Private media links
Previews use signed links that expire. Forged or expired links are refused; deleted files stop opening.
Server-side publishing
A dedicated scheduler sends posts. Nothing is published straight from a browser.
No double posts
A unique publish key per post makes retries safe.
Roles
Viewer, editor, admin and owner, per organisation.
Audit trail
Create, edit, approve, schedule, publish, retry, cancel and delete are recorded.
Coming next
On the roadmap.
- →A kill switch to pause all publishing, and a pause per account.
- →Signed R-Series receipts for publish and approval actions, with content and media fingerprints.
- →Alerts for expiring tokens, failed publishes and empty queues.
Early access
Your channels, on one calendar.
AI drafts. A person approves. Reach publishes on time and keeps the record.