Content Author Role Can Publish Content in a CMS Workspace

Root Cause: Role Hierarchy Inheritance

CMS Workspace contributor roles are inherited through the Salesforce organization's role hierarchy. If a user with the "Content Author" role is higher in the organization's role hierarchy than a user with stronger CMS permissions (such as "Content Admin" or "Content Manager"), the Content Author inherits the more permissive access level of the lower-hierarchy role, allowing them to publish content despite their "Content Author" designation.

Resolution: Restructure Role Hierarchy to Prevent Permission Inheritance

To prevent this issue, ensure that users with stronger CMS Workspace access permissions (Content Admin, Content Manager) are not placed in roles lower in the organization's role hierarchy than users with less permissive roles (Content Author).
To review and restructure your org's role hierarchy:

1. Navigate to Setup > Users > Roles.
2. Review the hierarchy and identify any Content Admin or Content Manager users placed in roles below Content Author users.
3. Move the higher-permission users to appropriate positions higher in the hierarchy, or restructure roles to reflect the intended permission model.