Keystonejs

Authentication and access control are defined in the KeystoneJS schema using access control functions. These functions evaluate per-operation, per-item, and per-field access rules — enabling fine-grained authorization that maps to specific agent roles. Self-hosted deployments manage authentication through the KeystoneJS session system or external identity providers.

KeystoneJS is an open-source headless CMS and application framework that generates a GraphQL API and admin UI from a TypeScript content schema definition. Unlike hosted CMS platforms, KeystoneJS is a self-hosted framework where teams define their content model in code and get a production-ready CMS with API and admin interface. For agents, the auto-generated GraphQL API mirrors the content schema exactly — every content type and field defined in the schema becomes queryable and mutable through GraphQL.

Reliability for self-hosted KeystoneJS is the team's operational responsibility. KeystoneJS runs on Node.js with PostgreSQL or SQLite — production deployments require appropriate Node.js hosting and database management. The framework's maturity and active development provide a stable foundation for production CMS infrastructure.

The auto-generated GraphQL API provides full CRUD operations on all content types defined in the schema. Agents can query content with filters, pagination, and relationship traversal; create and update content entries; and manage file/image uploads. The schema-driven approach means the API shape is predictable from the content model definition — agents can reason about available operations from the schema.

Documentation covers the schema definition, GraphQL API, access control, and deployment patterns. The access control documentation is particularly detailed for teams building multi-role CMS environments. Teams evaluating KeystoneJS versus Strapi for self-hosted headless CMS should compare the schema-as-code approach (KeystoneJS) against the visual content type builder (Strapi).