01
Tenancy
Each agency is isolated. Sites, members, preferences, contracts, and integrations do not leak across tenants. Operators and viewers only see the sites they are scoped to. Clients see their own site.
Security & trust
A system that changes live client sites has to be boring about safety.
Orbit Webmaster is built so the dangerous thing is hard, the recorded thing is default, and the model never gets to skip the queue.
02
The WordPress connector
Per-site connection tokens, hashed and encrypted, rotatable and revocable. The plugin is a thin execution and discovery layer. Business logic, credentials for hosts, and AI all stay on the server.
03
AI boundary
AI proposes descriptions, classifications, and (later) plans. It does not run actions. Directory changes need a human. Manual site text is never overwritten by a regenerate. When plans exist, they pass schema, permission, capability, and lock checks before anything is queued.
04
How work is supposed to run
Typed actions. Idempotency. Site locks so two workflows do not mutate the same production at once. Environment locks on deploy. Approval when the action is destructive or the screenshot diff is unclear. History you can query: who planned, who approved, what ran, where, and what came back. Failed tasks do not consume hours.
05
Staging before production
Updates are modelled as clone → change → look → ship. File rollback on a live site is not a strategy.
06
Static sites
GitHub sync uses repository access to read the source of truth and detect drift. It is not a backdoor deploy that skips your existing pipeline.
What we will not build
Orbit will not help you share paid plugin licenses, mutualise GPL zips, or bypass vendor terms. That is a product rule, not a later setting.
Per-site tokensTenant isolationTyped, logged actionsHuman approval on destructive workNo raw write-handle for AI