Sanity

Schema-as-code in TypeScript with a broad field set (string, text, number, boolean, date, datetime, geopoint, slug, url, reference, image, file, block, object, array) plus arbitrary nesting and polymorphic arrays and references; TypeGen generates query types. Not higher because there is no discriminated-union type and the GraphQL layer forces inline object types into global scope.

References accept multiple target types (polymorphic), arrays of references give many-to-many, GROQ references() queries any relationship from the other end, and Studio shows incoming references in the form; cross-dataset references span datasets. Not higher because reverse links are computed by query rather than modelled as first-class bidirectional relations.

Unlimited nesting of objects and arrays, block arrays as the standard page-builder pattern, and Portable Text with embedded custom blocks and inline objects make Sanity a reference implementation of structured composition. Not higher because the Portable Text data-loss bug that forced npm deprecation of Studio v6.9.2 to v6.14.0 in September 2026 shows rough edges in the editor layer.

The Rule API covers required, min/max, length, regex, uniqueness and custom async rules with access to the whole document, so cross-field and remote checks are possible, and headless validation can run from the CLI. Not higher because validation runs in the Studio and CLI, not on writes through the Mutation API, so API imports can store invalid content.

Every mutation is kept as history with per-field attribution, a side-by-side compare view, one-click restore of earlier revisions and restore of deleted documents, and Content Releases add version documents per release. Not higher because history retention is tied to plan, there is no content branching, and Releases with revert are Enterprise features.

There is no first-party taxonomy feature: classification is modelled as tag or category document types joined by references, which are reusable across types and fully queryable through GROQ. The community Taxonomy Manager plugin on the Sanity Exchange adds SKOS-compliant hierarchical taxonomies and thesauri, and Media Library aspects give assets metadata schemas. Not higher because governance of terms, synonyms and hierarchy all depend on that plugin or hand-built schemas.

The Presentation tool previews drafts on the customer's real frontend with click-to-edit overlays, the Live Content API keeps preview in sync as editors type, and perspectives let editors preview releases and content variants; official toolkits cover Next.js, Nuxt, SvelteKit, Astro, React Router and React Native. Not higher because every frontend has to be wired for draft mode, overlays and resolvers by developers, and preview performance on large pages needs tuning.

Portable Text is a portable JSON AST with custom marks, annotations, inline and block objects, renderers for many frameworks, configurable editor behaviors and table editing. Not higher because the September 2026 data-loss regression shows reliability risk in the editor.

The asset pipeline offers URL-based resize, crop, hotspot and focal point, automatic WebP and AVIF, quality control, IIIF and a global asset CDN, and asset usage is visible through references. Not higher because organisation in the standard project asset store is thin; folders and metadata live in Media Library, which is an Enterprise feature.

Content Lake syncs edits in real time so several editors work on one document at once with presence, field-level cursors, comments with mentions, and tasks; history attributes each change. Not higher because there is no suggestion or tracked-changes mode.

Sanity Workflows defines stages, guards, actors with enforcement, subworkflows and an audit trail, and workflows can be authored through the MCP server, which matches the rubric for configurable routing. Not higher because Workflows is still early access at 0.x, so most teams today rely on tasks, comments and custom document actions for approvals.

Scheduled drafts on the Growth plan schedule single documents with timezone-aware times, and Content Releases bundle many documents, including unpublish actions, into one timed publish with a calendar of upcoming releases and full API control. Not higher because Content Releases is limited to certain Enterprise plans and capped at 1,000 documents per release, so Growth customers get single-document scheduling only.

Both field-level (internationalized-array) and document-level (@sanity/document-internationalization) localization are supported through official Sanity-maintained plugins, and locale queries are written in GROQ. Not higher because localization is not a platform primitive: fallback chains are hand-written with coalesce(), and Sanity says a first-party localization primitive is future work.

Custom roles use GROQ filters for document-level access, user attributes enable attribute-based rules, a visual role builder and Blueprints manage roles as code, and SAML SSO is available on Business and Enterprise plans. Not higher because custom roles are Enterprise-only, there are no enforced field-level permissions (conditional fields only hide or lock in the Studio UI), and SCIM provisioning is not documented.

GROQ over HTTP gives expressive filtering, joins, projections and pagination, perspectives switch between published, drafts and releases, the Live Content API streams updates, and a generated GraphQL API is also available. Not higher because GraphQL is read-only and exposes Portable Text only as raw JSON, so GROQ is effectively required.

The API CDN and asset CDN are global with automatic invalidation on publish, and sync tags with Sync Tag Invalidate Functions give targeted revalidation. Not higher because faster invalidation is reserved for the High Frequency CDN tier, private datasets and POST queries are not cached, and there is no edge compute.

GROQ-powered webhooks filter on any condition with delta functions, shape payloads with projections, sign requests, expose attempt logs, and can be managed as code with Blueprints; Functions add event-driven and scheduled handlers. Not higher because retries were cut to two attempts at 30-second intervals with one concurrent request and a 30-second timeout.

Content is fully channel-agnostic, Portable Text renders to web, native and other targets, and content is served to agents through MCP and Sanity Context. Not higher because official SDK coverage is concentrated on JavaScript and TypeScript, with other languages community-maintained.

Content variant definitions are key/value conditions such as audience: loyal that the frontend sends with each query; Sanity stores no visitor profiles, evaluates no behavioural rules and has no CDP connector. Not higher because segments are computed entirely outside the platform; not lower because variant conditions give segments a first-class place in the content model.

Content variants let one document carry alternative content per audience, market or test arm, with a Studio variant picker, Presentation preview per variant, variants inside releases and specificity-based fallback. Not higher because variants are a beta enabled per project and the decision of who sees what is made by the frontend or an external engine.

Sanity documents running a multi-arm test as variant definitions per arm, but traffic assignment, significance and reporting all happen in the frontend or a tool such as GrowthBook or LaunchDarkly. Not higher because there is no traffic split or results view in the product.

No recommendation engine exists; related content is curated by references or hand-written GROQ, and semantic similarity via embeddings must be assembled by developers. Not higher because nothing algorithmic ships for visitors.

Sanity documents site search through GROQ text matching, scoring and hybrid keyword plus semantic search over dataset embeddings, and maintains an Algolia sync (sanity-algolia with Functions). Not higher because there is no hosted visitor search with facets, typo tolerance, analytics or UI components; teams build the experience on the API or in Algolia.

Sanity has no catalog, cart, checkout, pricing or inventory; commerce is always an external platform. Not higher because nothing transactional ships.

First-party Sanity Connect apps sync Shopify products, variants and metafields into Sanity with outbound metafield sync, and Sanity Connect for Salesforce Commerce Cloud ships a cartridge, full and delta export jobs and a Studio plugin. Not higher than the integration ceiling allows, and slightly below it because live pricing and inventory are not federated and other platforms rely on starters and partners.

The Dashboard shows content operations insights such as work in progress, releases, document types and recent publishing, and request logs report API and bandwidth use. Not higher because there is no page or content performance analytics for visitors.

Analytics and tagging live in the customer's frontend; Sanity contributes request tags for log delivery, Functions and webhooks for pushing events, and App SDK apps for custom dashboards. Not higher because there is no GA4, Adobe Analytics, Segment or Amplitude connector.

One dataset can serve many sites with shared documents filtered per site, workspaces give per-site Studio configurations, cross-dataset references share content across datasets, and the organization Dashboard groups studios and apps. Not higher because there is no site object or central multi-site governance UI; the site model is designed by developers.

Sanity lists adapters for translation services, including Smartling and Transifex, alongside AI Assist translation of documents and fields inside the Studio. Not higher because there is no built-in translation memory, glossary or batch job management, and some adapters lag behind current plugin versions.

Organizations hold many projects with organization-level roles, an activity log, user attributes for parameterised access and Blueprints to apply the same roles and settings across stacks. Not higher because custom roles are Enterprise-only and there are no cross-brand approvals, shared component libraries with overrides or policy enforcement.

Media Library adds organization-wide assets with aspects for custom metadata, folders, asset versions, visibility and signed URLs, cross-project sharing and dataset-aware usage tracking. Not higher because it is a paid Enterprise feature with no rights or expiry management, asset approvals or brand portal.

Media Library video provides Mux-backed transcoding and adaptive streaming, playback policies with signed URLs, subtitle upload and generation, versioning and original file storage. Not higher because it needs both Enterprise Media Library and a separate video add-on, and there is no 3D or interactive media support.

Presentation lets editors compose pages from developer-defined blocks with live preview on the real frontend and drag-and-drop reordering of arrays in the preview. Not higher because there is no no-code page creation, template locking or layout grid; the component palette, overlays and drag targets all have to be built and wired by developers.

Sanity hosts the Studio and App SDK apps on sanity.studio but does not render or host the customer's website; frontends run on Vercel, Netlify or similar with official starters and quickstarts. Not higher because there is no frontend hosting or site SLA; not lower because deployment guidance and Vercel integration are first-party.

No visitor form builder or submission storage exists; forms are built in the frontend or with an external form service. Not higher because nothing ships.

There is no ESP connector, email composer or email preview; pushing content to an ESP means writing a Function or webhook handler. Not higher because there is no packaged integration path.

Document and scheduled Functions can trigger external systems on content events, but there are no campaigns, nurture flows, lead scoring or lifecycle stages. Not higher because automation of marketing is entirely outside Sanity.

SEO metadata is modelled as schema fields, often with community SEO plugins and starter templates, and is exposed through the API; sitemaps, redirects, canonicals and JSON-LD are built in the frontend following Sanity guides. Not higher because there is no native redirect manager, sitemap generation or SEO recommendations.

Structured content makes llms.txt, Markdown endpoints and JSON-LD straightforward to generate, and Sanity does this for its own docs, but nothing in the product generates them for customer sites or controls AI crawlers. Not higher because AI visibility is the frontend team's job; Sanity Context and MCP serve agents and are scored elsewhere.

The Sanity Exchange lists a large catalog of plugins, tools and starters, with first-party Shopify and SFCC Connect, Smartling, Mux, Cloudinary and Bynder integrations, a plugin kit and the App SDK for custom Dashboard apps. Not higher because many plugins are community-maintained with uneven upkeep and installs are code-level rather than one-click.

Sanity users and custom auth providers apply to Studio editors, not site visitors; gated content means the frontend authenticates visitors with its own CIAM and queries private datasets with tokens. Not higher because there is no visitor login, portal or consent layer.

GROQ remains a well-designed, fully specified query language with a published spec, cheat sheet, custom GROQ functions and a new "GROQ for GraphQL developers" translation guide; the Query HTTP API exposes the complete pipeline (joins, sub-queries, dereferencing, score()/order()) and the GraphQL API is still first-class enough to be cached at the CDN edge alongside /data/query. HTTP mutations follow clear REST conventions with date-based API versioning and documented error codes. The proprietary nature of GROQ remains the main criticism, but design quality and documentation are excellent.

Sanity publishes an unusually complete performance contract: per-IP rate limits (500 req/s global API, 25 req/s mutations, 25 req/s asset uploads), per-dataset concurrency caps (500 queries, 100 mutations, 5 exports), execution ceilings (1 min query, 3 min mutation, 5 min export) and an API CDN that is unmetered for cached responses across seven regional PoPs plus a global layer — and which serves the last cached content for up to two hours if Content Lake is unavailable. GROQ slicing handles pagination and batch mutations handle bulk writes. It falls short of 85+ because there is no published response-time SLA, the uncached api.sanity.io path is both slower and rate-limited, and the CDN caps POST bodies at 300 KB.

The JS/TS ecosystem is exceptional and current — @sanity/client v8.7.0 (Sept 2026, now ESM-first with Node 22.12+ require() interop), @sanity/sdk-react v3.5.0, next-sanity, sanity-astro, sanity-sveltekit, @sanity/image-url and @portabletext/react, plus official starter templates for Next.js, Nuxt, Astro, SvelteKit and Angular. Official coverage outside JS is thin: sanity-io/sanity-php is the only other org-maintained client (last pushed Aug 2026, ~35 stars), and there is no official Python, Go, .NET, Ruby, Java or mobile SDK, so those backends call the HTTP API directly. Per the rubric that is effectively two official languages rather than the 6+ needed for 80+, but the depth and TypeScript-first quality of the JS line place it well above the 55–70 band.

The sanity.io/plugins directory is large and actively maintained (dozens of entries per page, mixing official plugins such as Google Translate and Amplitude with community work), and the AI/agent surface keeps widening: the MCP Server is GA in the official MCP Registry, Content Agent runs in Slack and via API, and Sanity Context added Knowledge Bases indexing datasets, websites and PDFs. Functions — now with function-to-function invocation, scheduled and pub/sub triggers — cover serverless integration glue. It stays mid-range because there is still no formal marketplace with ratings, vetting tiers or commercial listings the way Contentful and WordPress have.

Sanity's extensibility is best-in-class among headless CMS platforms and widened again in 2026: Studio v6 (6.16.0, Sept 2026, on Vite 8) is fully extensible via React — custom inputs, document views, actions, tools and structure builder — while the App SDK ships standalone custom React apps with auth, caching and live updates. Blueprints now declare the whole project as versioned code (Studio, schema, CORS, webhooks, robot tokens, roles, functions) with a resource graph, rollbacks and org-scope promotion, Functions add serverless, scheduled, pub/sub and function-to-function execution, and the MCP server plus custom GROQ functions extend the model to agent-driven operations. Nothing in the rubric's 75+ bar is missing.

SAML SSO is Enterprise-only but well documented, with JIT provisioning, automatic role mapping from IdP groups and vendor-specific walkthroughs for Azure, PingIdentity and JumpCloud. Token management is a genuine strength — robot tokens declared in Blueprints, least-privilege deploy tokens minted via the CLI that cannot create stacks or mint further tokens, and CLI-managed expiry. It sits at the lower end of the Enterprise-gated band because Sanity's own security page states that account login runs only through external Google/GitHub OAuth "optionally with two-factor", meaning MFA is delegated to the IdP with no Sanity-enforced policy, and no SCIM provisioning appears anywhere in the docs.

The model now clears the rubric's 80+ bar on both axes: field-level permissions restrict individual fields, and User Attributes give true content-instance scoping by letting roles filter documents through user::attributes() GROQ expressions (attributes synced from SAML at login or set manually). Custom roles are buildable both programmatically via the Access API and through a visual role builder in Manage, and roles can be declared as code in Blueprints. Enterprise gating of custom roles and User Attributes keeps it from scoring higher.

Sanity is SOC 2 Type 2 certified, but its own security page scopes the examination to the Security principle alone rather than the full Trust Services Criteria, and the ISO 27001/27017/27018, PCI DSS and HIPAA certifications it cites belong to Google Cloud as the host, not to Sanity. GDPR/CCPA posture is solid — a public DPA plus EU representative and DPO contact fields in project settings — and content is stored in the EU/EEA by default. It sits mid-band rather than at 80+ because Sanity holds no ISO 27001 of its own and offers no HIPAA BAA, and because the backend runs in a single EU region with customer-controlled data placement still described as a future plan.

The record itself is clean — the GitHub Advisory Database returns zero npm advisories across sanity, @sanity/client, next-sanity and @sanity/cli, and there is no publicized breach — and the responsible-disclosure policy commits to acknowledging reports within one business day, backed by an unusually detailed public security page covering encryption, employee access and infrastructure. It cannot reach the rubric's 70+ tier because Sanity's security page states plainly that it does not run a bug bounty program issuing rewards, leaving a VDP as the only external research channel.

Content Lake is SaaS-only with no self-hosted backend, and the regional story is narrower than previously credited: Sanity's security page says the backend runs across three data centers in a single EU region (Belgium), with "fully global backend infrastructure, with customer-controlled data placement" described as a plan rather than a shipped option. There is no US dataset region, no private cloud and no air-gapped path. Studio self-hosts anywhere as a static React app and the API CDN has seven regional PoPs, which keeps it inside the SaaS-only 50–60 band rather than at the bottom of it.

99.9% uptime SLA on Enterprise only, with a public, well-run status page and clear postmortems. The incident cadence that resumed in summer 2026 continued straight through September: elevated API errors affecting write mutations for a subset of projects (Sept 15), elevated API errors (Sept 22) and listener latency degrading Studio (Sept 23), on top of Jul 22 Studio connectivity and four August incidents. Each was detected and resolved within minutes to an hour, but eight-plus incidents in three months against a 99.9% (not 99.95%+) SLA with no coverage on Free or Growth holds it in the 60–75 band.

Sanity publishes hard scale numbers rather than vague assurances: 1,000,000+ documents and 8,000 attributes per document on Enterprise, 10 GB of JSON and 32 MB per document, 10,000 concurrent listeners, 500 concurrent queries and 100 concurrent mutations per dataset, and a 500 MB working-set ceiling. The managed Content Lake auto-scales behind a seven-PoP API CDN, Functions add managed compute, and Nike, Figma and Cloudflare are public references at scale. It stops short of 85+ because meaningful capacity is Enterprise-gated (Free caps at 10,000 documents, Growth at 50,000) and the backend still runs in a single region.

Sanity publishes actual recovery objectives, which the rubric's 75+ tier requires: a region-wide disaster is committed to "fully recover to a different region with no data loss within 12-24 hours," and databases are continuously backed up with point-in-time restore to any moment in the past 30 days at per-transaction precision, with assets replicated across multiple EU regions and 7-day historical-version backups. Daily cross-account, cross-region DR copies are accessible to only two employees, Enterprise adds managed dataset backups (daily, retained 365 days, plus weekly for two further years, offsite), and sanity dataset export gives every plan a full NDJSON tarball. It is held under 85 because the managed dataset-level backup service is Enterprise-gated, comments and document history are excluded from those backups, and a 12–24 hour RTO is only moderate.

Local DX is excellent: the Sanity CLI covers init, dev with hot reload, deploy, dataset management, typegen, migrations, blueprints and local Functions testing, Studio v6 on Vite 8 cut build times by a median ~4.8x with smaller bundles, and projects can now be provisioned with no account at all using temporary 72-hour credentials for humans or agents. Two caveats hold it below 88: there is still no offline mode — local Studio requires connectivity to the cloud Content Lake — and the v6 line shipped a Portable Text data-loss regression that spanned six releases (6.9.2 through 6.14.0, now deprecated on npm) before being fixed in 6.14.1, a real release-quality cost for teams tracking Studio upgrades.

Blueprints turned this from a gap into a strength: a single versioned blueprint file drives multiple stacks for staging and production, deploys from any CI system with a scoped mint-deploy-token that cannot create stacks or mint further tokens, has an official GitHub Action, and documents errors, rollbacks and organization-scope promotion. Dataset Hot Swapping supplies genuine environment aliasing — a read-only alias repointed between prepared datasets with no migration — while Cloud Clone copies production data inside Sanity's infrastructure explicitly for CI test runs, alongside the content migration CLI with dry-run mode and CI-friendly sanity schema validate. It stays below 85 because aliases and Cloud Clone are both Enterprise features, so mid-tier teams fall back to manually managed datasets.

One of the strongest doc sets in the headless space and visibly maintained — 600+ indexed pages, a public changelog tracking the Studio v6 line, hard technical-limit and rate-limit tables, the GROQ spec plus a GROQ-for-GraphQL-developers migration guide, IdP-specific SSO walkthroughs, and current coverage of App SDK, Functions, Blueprints, MCP, Sanity Context and the migration CLI. It is also unusually machine-readable: every article exposes a .md alternate and the docs publish an llms.txt index for AI agents, with official clean templates for Next.js, Nuxt, Astro, SvelteKit and Angular. Held below 90 because some operational facts (notably data residency and recovery objectives) live only on the marketing security page rather than in the docs, and advanced topics remain thinner than the core.

TypeGen (GA) generates precise types from both the Studio schema and GROQ query strings via defineQuery, with auto-regeneration during sanity dev, custom GROQ function support, type hoisting for reused objects and parsing of .svelte/.vue/.astro files. @sanity/client is now v8 — ESM-first and fully typed — @sanity/sdk-react hooks are strongly typed, and IDE support is backed by the official VS Code extension and a published typedoc reference. This is at the top of the market; only the absence of typed tooling outside the JS ecosystem keeps it from higher.

The official changelog JSON feed carries 200 entries between 2025-12-19 and 2026-09-23 with never fewer than 18 in any month (Jan 20, Feb 18, Mar 20, Apr 19, May 26, Jun 22, Jul 20, Aug 24, Sep 27), spread across eight actively shipping products — Studio (62), MCP server (49), Media Library (24), App SDK (18), Manage, Context, Functions, Content Lake. Studio alone tagged 61 GitHub releases in 2026, going from the v6.0.0 major (Jun 11) to v6.16.0 (Sep 22). Not higher because this is the ceiling the dataset's best SaaS vendors already occupy, and the pace outruns QA — see 4.1.4.

sanity.io/docs/changelog is a single canonical feed covering every product with per-product filtering, a machine-readable full-body JSON feed, and an explicit 'Breaking changes' block plus a linked migration guide on each major (Studio v6, @sanity/ui v4, JS Client v8, App SDK v3, next-sanity v13). The standout is retroactive safety: when the Portable Text data-loss bug was found, Sanity added a 'This version is deprecated' banner to all seven already-published entries from v6.9.2 to v6.14.0 pointing at the fix. Not higher because breaking changes are curated prose rather than a machine-parseable field, and the JSON/RSS endpoints are undocumented.

Direction is communicated through GitHub Discussions (categories include Announcements and 'Requests for comment (RFC)'), the Everything *[NYC] 2026 release event, frequent 'What's New' posts, and now formal preview programs — Workflows ships under a documented 'How early access works' contract and Content Variants is a per-workspace beta, correcting the prior scoring's claim that no feature-preview program existed. Held just under the rubric's 70+ band because there is still no public roadmap board, no voting portal, and no committed delivery dates; buyers can see what is in preview but not what is queued.

A Portable Text Editor data-loss bug shipped in Studio v6.9.2 (Aug 11) and went undetected for five weeks across seven releases until v6.14.1 (Sep 16) deprecated v6.9.2-v6.14.0 on npm; handling after discovery was exemplary, but the regression reached a patch release in the flagship editor. Separately, H2 2026 stacked five breaking majors in three weeks — @sanity/ui v4 (Aug 10, ESM-only, Node 22.12, React 19.2), JS Client v8 (Aug 12), Context v1.0 (Aug 11) then v2.0 deprecating the Studio plugin three weeks later (Sep 3), App SDK v3 (Aug 25) — and the sanity-import CLI binary was removed outright in @sanity/import v5.0.0. Not lower because every major ships a migration guide, a sanity@next-major pre-release channel exists and in-product deprecation banners are used; not higher because deprecation windows are weeks, not the 12+ months the rubric rewards.

Package reach grew roughly 2.5x inside 2026: the sanity package went from 1.41M monthly downloads in January to 3.48M in the last 30 days, and @sanity/client from 4.44M to 10.93M. GitHub sits at 6,331 stars and 553 forks, and the Exchange holds a large user-generated corpus — 2,751 community answers, 795 showcase projects, 435 guides, 335 plugins and 146 templates, alongside an active Discord. Not higher because the 6.3k star base is modest for an open-source-core product and the absolute community remains an order of magnitude below WordPress or Drupal.

The issue tracker is actively worked rather than accumulating: 42 issues opened and 50 closed in the sanity-io/sanity monorepo since 2026-06-01, leaving only 67 open, against 915 pull requests closed since 2026-08-01. Community contribution is real too — 292 of the 335 Exchange plugins are community-built, plus 435 community guides and 2,751 answered questions, and the team runs Discussions with a dedicated RFC category. Not higher because several RFC and Support discussions sit unanswered for months and the Discussions board is far quieter than the issue tracker.

Sanity does run a formal certification program — sanity.io/learn/certification hosts the 'Sanity certified content operator' exam backed by five prerequisite courses — which corrects the prior scoring's claim that certification exams were absent. Against that, the technology-partner directory lists only ~15 partners (Algolia, Cloudinary, Shopify, Vercel, Netlify, Mux, Phrase, Smartling, Transifex, Uniform and similar), the agency directory is a client-rendered filter page with no per-agency pages in the sitemap and no published partner count, and no Accenture/Deloitte/Capgemini-scale SI is named anywhere on the site. Net unchanged: a real but shallow bench versus enterprise DXPs.

The community-authored corpus is large and measurable: 435 guides, 795 showcase projects and 2,751 answered questions on the Exchange, on top of agency deep-dives (Pagepro, Represent, Roboto Studio, Webstacks, WeframeTech), YouTube tutorials and Udemy courses, with the March 2026 AI Content OS launch drawing independent trade coverage. First-party learning is also unusually deep at 139 free courses across 3 tracks, which lowers learning cost even though it is vendor-produced. Not higher because content still skews heavily to JavaScript/React developers, dedicated books are absent and analyst/enterprise-press coverage is thin.

The on-ramp improved materially: a formal certification with an exam plus 139 free courses and 3 structured tracks means React/Next.js developers can be brought to a verifiable baseline quickly, which the rubric explicitly credits, and schema-as-code keeps the transferable skill set close to mainstream JavaScript. Job postings mentioning Sanity continue to grow, concentrated in digital agencies. Still niche rather than widely recognized: only one certification exists, and dedicated Sanity specialists remain far scarcer than WordPress, Drupal or Contentful developers.

Sanity publishes 32 named customer stories with a steady 2026 refresh — Puma, Tecovas, Braze, Mejuri, Amplitude, Cloudflare, Eurostar, Tata, Complex, loveholidays, Morning Brew, Lady Gaga — several with quantified outcomes (loveholidays cut translation cost 97% and market launch from 3 months to 3 days). The Everything *[NYC] 2026 conference in September anchors a 40-page events program. Not higher because the logo list turns over slowly and Sanity still announces fewer net-new enterprise wins per quarter than tier-1 vendors like Contentful or Adobe.

The $85M Series C led by Bullhound Capital (May 2025, with Shopify, ICONIQ Growth, Heavybit and Threshold) is now roughly 16 months old with no Series D, and Sanity stated at the time it was fully capitalized with no plans to raise — healthy, but the freshness the rubric rewards has faded. Headcount trackers now disagree sharply (317 in July 2026 per one source, 242-246 per others), so the previously cited 218 -> 294-314 climb cannot be substantiated. No layoff, distress or acquisition signals in any 2026 source, and sustaining 20+ shipped releases a month is itself evidence of engineering capacity.

The 'Content Operating System for the AI era' line is coherent and backed by shipped surfaces rather than slideware — the MCP server alone accounts for 49 changelog entries in 2026 (v2.35.3 by Sep 23), alongside Content Agent, Sanity Context 2.0, Functions and the App SDK — a genuine edge over Contentful, Contentstack and Storyblok, reinforced by Shopify Certified Plus Partner status. Docked because the two headline Everything *[NYC] 2026 announcements are not GA — Workflows is early access on a fixed 0.x stack and Content Variants is a per-workspace beta — and Content Releases is gated to certain Enterprise plans, so the differentiating story is thinner than the launch coverage suggests. Sanity also remains absent from the Gartner DXP MQ (2026 edition led by Optimizely), the Forrester Wave and IDC MarketScape while Contentstack holds MQ placement.

Sources conflict on the G2 figures this cycle: grounded search returns 4.7/5 across ~926 reviews with a #1-headless-CMS-for-four-consecutive-years badge, while the prior scoring read ~412 reviews at 4.5/5 off the live page — g2.com now returns 403/CAPTCHA to direct fetches, so neither could be re-verified. Both readings sit inside the rubric's 4.5+/200+ band, so the score holds. Recurring negatives keep it off the ceiling: GROQ learning curve for non-developers, cost at high API volume, and configuration effort versus out-of-the-box CMSes; the Aug-Sep Portable Text data-loss deprecation is too recent to appear in review data.

Disclosure below Enterprise is exceptional: sanity.io/pricing publishes Free $0, Growth $15/seat/mo, a ~130-row feature matrix, every overage rate ($1/250K CDN requests, $1/25K API requests, $0.30/GB bandwidth, $0.50/GB assets, $0.05/AI credit, $1.50/1K embedding queries, $1/1M function invocations, $1/20K GB-seconds) and every add-on price ($799/mo dedicated support, $299/mo increased quota, $999/dataset/mo extra datasets), and the docs spell out the exact HTTP 402 `plan_limit_reached` behaviour at 100% quota. It is still the industry-norm pattern of public self-serve tiers with a sales-gated Enterprise plan — where all security, governance and SLA terms live — so it sits above that band's ceiling for depth but cannot reach the all-tiers-public range. Scored down from the prior 80, which over-credited the pattern and also assumed a ~20% annual discount that the pricing FAQ explicitly denies.

Per-seat pricing is predictable (viewers free), but the metered surface has widened in 2026 to eight dimensions — API CDN requests, API requests, bandwidth, assets, AI credits, embedding queries, function invocations and GB-seconds — on top of two structural cliffs: the Growth document quota is a hard cap (25k, no overage allowed) that blocks creating documents *and drafts* until you buy the $299/mo add-on or move to Enterprise, and extra datasets cost $999/dataset/mo, a punitive price for the routine need to separate staging from production. The 10× gap between CDN and direct-API request rates still makes a misrouted client an order-of-magnitude bill event. Sanity has genuinely improved cost control — 4xx/5xx responses and Studio/Dashboard traffic are never billed, the Manage Costs page was overhauled in April 2026 to itemise what is driving the invoice, 80%/100% usage alerts go to admins, and Content Agent pauses for confirmation above 100 AI credits — which is why this does not fall further.

Gating regressed materially this cycle: the SAML SSO add-on that Growth customers could previously buy for $1,399/mo is gone — the pricing table now shows SSO "Not included" on Free and Growth, and the Growth add-ons doc (updated 2026-07-27) lists only three add-ons (dedicated support, increased quota, extra datasets), so SSO has no purchase path short of an Enterprise contract. Four of the rubric's named anti-patterns are now Enterprise-only at once — SSO, full audit trail and History API, custom roles and custom access control, and the uptime SLA — joined by backups, dataset hot swap, cross-dataset references, cloud cloning, Content Releases, Media Library, custom CDN domains and invoicing; Growth caps at 5 roles and gets only community support unless it pays $799/mo. It does not score lower because the actual content platform is ungated: GROQ and GraphQL, Portable Text, real-time editing, multiplayer presence, visual editing, the image pipeline, free Studio hosting, Content Agent, Agent Actions, semantic search and Functions all ship on the free tier.

Sanity's own FAQ states there is no minimum contract duration, plan changes and cancellations take effect immediately and are prorated with a refund to the original card within 10 business days, downgrading to Free is just a plan change with no cancellation step, and projects can be transferred between organizations or archived instead of cancelled. Discount programs are real but narrower than they look — the Startup Program gives a year of free Growth (~$9k) only to portfolio companies of listed VC/incubator partners with <20 employees and <$5M raised, while the non-profit plan is genuinely open (free Growth-equivalent, 25 free seats then $15 each, 3 datasets) for small non-profits, smaller educational institutions and unmonetised open source. Held below 80 by two procurement frictions: self-serve is credit-card only with no invoicing, bank payment or PO below Enterprise, and there is no annual payment option — hence no annual discount — outside an Enterprise contract.

The 2026 quotas are now confirmed directly from the pricing table, resolving the conflicting third-party reports that suppressed this score last cycle, and the tier is among the most generous in the category: 20 seats, 10k documents, 2 datasets, 1M API CDN requests, 250k API requests, 100GB bandwidth, 100GB assets, free Studio hosting, real-time editing, multiplayer presence, visual editing, GROQ and GraphQL, plus 1000 AI credits, Content Agent, semantic search and 500k Function invocations — free forever, no credit card, commercial use permitted, with a 30-day Growth trial on every new project. Two real caveats keep it from scoring higher: free datasets are public-only, so content is world-readable, and the tier is hard-capped with no overage — hitting 100% of the API, CDN or bandwidth quota returns HTTP 402 and takes the production site's content offline until the monthly reset or an upgrade. Draft history is only 3 days.

`npm create sanity@latest` still yields a working Studio in minutes, and the on-ramp has widened: first-party quickstarts for Next.js, Nuxt, Astro and React Router, a templates gallery, dedicated "AI coding agents" and "AI app builders" docs, and every docs page served as `.md` alongside llms.txt, llms-full.txt and a markdown sitemap published explicitly for agents. The official MCP server is now a mature product shipping near-daily (v2.35.3 on 2026-09-23, 51 changelog entries) with schema discovery, asset upload and inline upgrade links on quota errors, so an agent can scaffold schemas and GROQ end to end. Studio v6's Vite 8 build (2–9× faster, current v6.16.0) keeps the edit-preview loop tight, and the no-card free tier removes procurement from the critical path entirely.

Agency-reported bands put a standard marketing site with a defined schema at 6–10 weeks, Shopify-backed headless commerce at 10–16 weeks, and an enterprise migration off Drupal or AEM at 16–24 weeks or more — modestly longer than template-driven CMSes because schemas-as-code front-loads content modelling and the frontend is always a custom build. Sanity's own tooling pulls in the opposite direction (framework quickstarts, a templates gallery, and a dedicated schema-change-management course with `sanity migrations` and `sanity documents validate` CLI tooling), keeping projects in the adequate range rather than the poor one. Confidence stays MEDIUM because no primary or first-party source publishes implementation timelines; the band comes from agency write-ups only.

The React/TypeScript foundation keeps the hiring premium low — roughly 10–15% over generalist React rates, nowhere near Sitecore or AEM territory — and the pipeline improved this cycle: Sanity Learn now runs structured tracks, courses and free certifications (including dedicated GROQ and schema-change courses), and the first-party MCP server plus Sanity Context let coding agents write GROQ and schemas for developers who have not internalised them. GROQ and Portable Text serialization still represent a genuine multi-week ramp and deep Studio customization expertise takes far longer to build, which is why this stays in the moderate band rather than climbing with the pure-React platforms.

There is no backend infrastructure line item at all: Content Lake, the global CDN and the image pipeline are bundled on every plan, and Studio hosting is explicitly free on every tier including Free — so the Studio does not even need a Vercel or Netlify account. Sanity Functions now bundles serverless compute too (500k invocations and 20k GB-seconds on Free), which removes the Lambda/Vercel function spend that webhook and automation glue used to require. The only remaining hosting cost is the frontend application, which is unavoidable in any headless architecture, so this sits just under the SaaS ceiling.

Near-zero ops burden — the Content Lake is fully managed with no database, patching or scaling decisions, and Studio is a static React app with no runtime servers, so a single developer can run production. Governance overhead also fell this cycle: a new Manage Security tab (September 2026) consolidates admin counts, non-expiring API tokens, CORS origins and dataset visibility into one review surface, and Function system logs now explain why a function did not run. The two ongoing chores that keep this from scoring higher are the Studio release treadmill (roughly weekly releases, v5→v6 major in June 2026 requiring Node 22.12+) and quota watching, since the Growth document cap blocks editors mid-work if nobody is monitoring usage.

The content data itself stays highly portable: `sanity dataset export` produces full NDJSON with assets attached, `sanity dataset import` round-trips it, the Content Lake is reachable over HTTP/GROQ/GraphQL at any time, Studio is open source, and Sanity documents its migration tooling thoroughly (`sanity migrations`, `sanity documents validate`, a content-migration cheat sheet and a schema-change course). Lock-in still lives above the data layer and grew this cycle: GROQ must be rewritten for any other platform, Portable Text needs conversion to Lexical or Markdown, Studio customizations are non-portable, and the 2026 "content operating system" surface — Functions, Agent Actions, Blueprints, App SDK, Media Library, Content Releases — adds proprietary runtime with no portable equivalent to rebuild on exit.

Sanity carries the heaviest proprietary concept load in the headless set — GROQ, Portable Text, Content Lake, perspectives, Structure Builder, schema deploy, App SDK, Canvas, Functions, Blueprints and Agent Actions — and the Sept 2026 v6.12–v6.16 releases are consolidation (Portable Text crash handling, presence, release perspectives) rather than new abstractions. GraphQL is available as an alternative to GROQ, and the concept set is coherent rather than overlapping, which places this in the rubric's 40–55 band for platforms requiring significant re-learning. Prior scoring put this at 30, below the rubric floor for that description and far under every headless peer; the low end of the band is the defensible placement.

Sanity now runs an exam-gated certification — 'Sanity certified content operator' at sanity.io/learn/certification, backed by five prerequisite courses (57 lessons) — alongside three curated learning tracks (Mastering content operations, Work-ready Next.js, Replatforming from a legacy CMS) and roughly 25 courses with video. Docs carry five framework quickstarts (Next.js, Nuxt, Astro, React Router, Studio) plus dedicated AI coding-agent and AI app-builder quickstarts, and llms.txt/.md URLs for every page. Prior scoring recorded 'no certification program', which is no longer true; the remaining gap is that the post-basics path is still spread across Learn, docs and the Exchange.

Excellent alignment with the React/Next.js ecosystem — next-sanity is a first-class integration with visual editing, and Studio v6 runs on Vite 8 with React strict mode default. Official clean templates now span six frameworks including SvelteKit, Remix and Angular, widening coverage beyond React. GROQ and Portable Text remain proprietary abstractions layered over otherwise standard tooling, which keeps this below the top of the range.

Official vendor-maintained clean templates now cover six frameworks (Next.js, Astro, SvelteKit, Remix, Nuxt, Angular), each bundling a co-located Studio, and Sanity also ships full-fledged official templates with example content — Blog and Personal Website with Built-in Content Editing, a batteries-included React Router template, and the AKVA Hydrogen commerce demo. A large third-party gallery (SanityPress, Schema UI, Turbo Start, Nuxion) extends coverage with Next.js 16 and Nuxt 4 stacks, and Vercel/Netlify one-click deploy is wired in. Breadth and official maintenance are the strongest in the headless peer set; it falls short of the top only because several of the richest templates are community or paid rather than vendor-maintained.

sanity.config.ts remains a single entry point working from 2–3 env vars, and setup friction dropped further in 2026: `sanity init --yes --dataset-default --template clean --typescript` runs unattended and automatically installs Sanity's agent skills and configures the MCP server, while `npx sanity@latest new` provisions a real project, dataset and token with no account at all. Studio v6.16 also deprecated the `createAuthStore` helper in favour of a plain `auth` config object, removing a layer of wiring. Production setups still accumulate plugin, Presentation and Studio-customization config, and the no-account path carries real caveats (72-hour expiry, no asset uploads, two fixed CORS origins), so this stays short of plug-and-play.

Schema changes are additive and safe — new fields, types, and validation rules don't break existing content, and there are no field count limits (unlike Contentful's 50-field limit). Sanity's migration tool handles schema and content migrations, and a dedicated Learn course ('Handling schema changes confidently') covers the workflow. Schema changes are still live with no staging environment for schema, and complex restructuring still requires scripted migrations, but overall constraints remain the lightest in the peer set.

Official visual editing guides now cover five frameworks — Next.js App Router and Pages Router, React Router, Nuxt and Astro 7 — closing most of the gap that previously made anything but Next.js a manual integration, and defineLive/sanityFetch handle draft mode, caching, revalidation and stega for Next.js. But Sanity's own architecture doc describes visual editing as seven distinct layers (client/stega, comlink, overlays, core-loader, preview-url-secret, Presentation, framework libraries) and is explicit that framework libraries only abstract part of it. Setup still means draft-mode routes, SanityLive in the root layout, document-to-URL resolvers and stega handling, which is squarely the rubric's 'requires frontend code changes but well-documented' band rather than plug-and-play.

A React/TypeScript developer can be productive on basic Sanity work in 1–2 weeks, and the 2026 agent tooling lowers the entry barrier — `sanity init` installs Sanity's best-practice skills and MCP server automatically, and Learn ships an 'AI-powered Sanity development' course. The new certification is optional rather than required, so it carries no rubric penalty. GROQ, Portable Text patterns and Studio customization remain non-transferable skills, and App SDK, Functions, Blueprints and Agent Actions each add their own specialization for advanced work, which keeps this mid-band.

A solo full-stack developer can build and ship a production Sanity site — the managed SaaS backend eliminates ops roles, and the agent-driven quickstart path now scaffolds schema, content and a frontend end-to-end in one session. A typical small project needs 1–2 developers; complex builds with visual editing, App SDK customizations and Functions benefit from 2–3 with different specializations. No separate DBA or ops engineer is required.

Content editors self-serve day-to-day operations — text, images and structured content updates without developer involvement — and real-time collaboration, Canvas, Content Releases and the Content Agent reduce friction further. But creating new page types, content models or templates still requires a developer to change schema code and run `sanity schema deploy`, and the Studio is form-based rather than a visual page builder, so editors cannot compose new layouts independently. That schema-as-code coupling is the structural reason this sits below Contentstack and Storyblok.

Staying current is mechanically easy — Studio is an npm package, `autoUpdates` applies patches, minors and runtime-only majors without a redeploy, Sanity maintains its own Renovate preset, and the v6 line shipped 16 minors (v6.0.0 Jun 11 → v6.16.0 Sep 22, 2026) with schemas, config and content APIs untouched plus a migration guide per major. Staying current *safely* regressed in 2026: a Portable Text data-loss bug shipped in v6.9.2 (Aug 11) and was not fixed until v6.14.1 (Sep 16), forcing Sanity to deprecate v6.9.2–v6.14.0 on npm — seven releases that auto-updating Studios had already pulled down automatically. Not scored higher because auto-updates amplified rather than contained that defect and because peer packages moved in parallel outside the auto-update path (Sanity UI v4.0.0 now requires an explicit stylesheet import, JS Client v8.0.0 went Node 22+ and ESM-only); not lower because no content-model or API migration was ever required.

The Content Lake is SaaS and patched by Sanity with no customer action, and the npm surface is unusually clean: a GitHub Advisory Database query returns zero advisories for `sanity`, `@sanity/client`, `@sanity/ui`, `next-sanity` and `groq` (the same query shape returns results for peer packages, so this is a real zero, not a broken query). Sanity also shipped customer-side hardening in 2026 — a free read-only Security tab in Manage (Sep 1) flagging non-expiring tokens, over-broad CORS origins, publicly readable datasets and admin count, plus settable API token expiry (Jun 12) — on top of a published responsible-disclosure program. Not scored higher because Studio dependency patching is still the customer's npm audit job and Sanity has no security advisory channel for Studio itself: the v6.9.2–v6.14.0 data-loss defect was communicated through an npm deprecation and a changelog post, not an advisory feed.

2026 produced a steady drip of vendor-timed breakage: both official i18n plugins (sanity-plugin-internationalized-array v5.0.0 and @sanity/document-internationalization v6.0.0, Mar 11) pivoted the language identifier from `_key` to a `language` field — a stored-data format change requiring a dataset migration, not just a code bump; the `sanity-import` CLI binary was removed the same day; the webhook retry policy was unilaterally downgraded on Apr 29 from 30-minute exponential backoff to two retries at 30 seconds, changing production integration behaviour with no migration window; Scheduled publishing is now marked deprecated in favour of Scheduled drafts; and @sanity/context v2.0.0 (Sep 3) deprecated the Studio plugin roughly three weeks after Context v1.0.0 shipped. Not scored higher because Studio majors now land about every six months, each forcing a runtime bump, and the above land on top of that; not lower because the Content Lake HTTP API is date-pinned with backward compatibility, core schemas and content APIs have survived v3→v6 untouched, and the only genuinely painful sunset (v2→v3) had a multi-year window.

There is no server-side dependency graph to manage at all — no database, search cluster, cache or CDN to run — and the client-side tree has a clean security record, with zero GitHub advisories across every published Sanity npm package and the long-running esbuild/prismjs audit complaint (issue #9017) closed in Sep 2025. v6 standardised the tree on Vite 8, React 19.2, Node 22.12 and ESM-only packaging, Sanity UI v4 added subpath imports to cut bundle size, and Sanity publishes a maintained Renovate preset so the tree can be kept current automatically. Not scored higher because the Studio is still a real React application the customer owns, deploys and audits, and peer-dependency coupling bites in practice — @sanity/context v2 requires @sanity/client ^8.4.0, which means sanity 6.12+; Sanity UI v4 now requires an explicit stylesheet import; the JS client is ESM-only from v8.

The built-in surface is broad for a headless SaaS: an Atlassian Statuspage tracking 26 discrete components with email/SMS/Slack/RSS subscriptions, request logs delivering every API and CDN request as NDJSON with `@sanity/client` request tags for attribution, an Activity Feed with CSV export, Functions system logs that explain rate limiting, quota exhaustion and recursion blocking, 80%/100% quota email alerts, the Sep 2026 Security tab, and — correcting an earlier assessment — both an attempts log and a message log per webhook, exposed as API endpoints, so webhook delivery health is natively observable. Not scored higher because there is no native APM, tracing or OpenTelemetry export and no customer-defined alerting, self-serve request logs are a manual pull capped at 1 GB / last 7 days / one export per 24 hours (silently truncated beyond that), Activity Feed retention is 90 days on Growth and the content-change audit log plus History API are Enterprise-only — and with ~50 published incidents in 11 months including 7 rated major, independent synthetic monitoring is not optional.

Hygiene tooling is genuinely good: reference integrity is enforced by the Content Lake, Studio ships an incoming-references view (v5.8.0), the Media Library adds in-use reference tracking, dataset-aware asset usage, folders and version cleanup, schema-as-code keeps the model in version control, and the MCP server plus Content Agent let teams run audits and bulk edits conversationally. Against that, Sanity imposes an ops burden peers do not: the Growth plan hard-caps documents at 25k with no overage allowed, drafts and Content Release versions each count as separate documents, and hitting the cap blocks creating any new document including drafts — with deletions taking up to an hour to register — so pruning becomes mandatory recurring work; backups are also 'Not included' on Free and Growth, leaving scheduled `sanity dataset export` as the customer's own job. Not scored higher because of those two gaps plus the continued absence of orphan detection, broken-link checking, content expiry workflows and any content health dashboard.

Delivery performance is almost entirely vendor-handled — the API CDN and Live CDN do caching and global distribution, the Image URL API handles responsive image optimisation, and groq2024 is the default search strategy from v6 — leaving GROQ query shape (deep joins) as the main customer-side lever, now diagnosable through request tags and the request log export. Not scored higher because 2026 shows recurring vendor-side performance degradation the customer cannot tune around: two separate query-performance incidents in June (Jun 15 and Jun 25) and elevated listener latency slowing Studio in both Feb and Sep, alongside Live Retention fixed at 15 minutes and 1k Live Connections per dataset on Free and Growth.

The pricing table is unambiguous: community support is the only support included on Free and Growth, dedicated support is a $799/month Growth add-on that buys 'direct technical support from Sanity's Support Engineers over email', and both dedicated support and the uptime SLA are 'Not included' on Growth — as are the onboarding program and Content Operations Specialists. No response-time commitment is published at any tier; the only SLA Sanity sells is an uptime SLA and it requires an Enterprise contract. G2 rates quality of support 8.9 across 900+ reviews, but reviewers specifically call out response time as the area needing improvement. Not scored higher because a Growth customer pays $799/month on top of $15/seat for email support with no published response SLA; not lower because that add-on is genuinely self-serve rather than sales-gated and the underlying support quality is well rated.

The community is well staffed and responsive — core engineers answer in the official Discord, GitHub Discussions is enabled on sanity-io/sanity, and sanity.io/answers is a real searchable Q&A portal carrying 110 official and 1,494 community answers. It is, however, much smaller than previously credited: the official Discord invite shows 5,055 members and 313 online, not the 35K+ figure earlier scores cited, and public Q&A outside Sanity's own properties is thin — the Stack Overflow `sanity` tag has 744 questions lifetime, its 30 most recent span Aug 2024 to Sep 2026, and only 12 of those 30 are answered. Not scored higher because community scale and off-platform coverage are modest for a tier-2 headless CMS; not lower because team participation is real, fast and concentrated in one well-moderated channel.

Backlog hygiene is excellent — sanity-io/sanity carries only 67 open issues against 6.3k stars, and over the last three months closed 36 issues while opening 31, with a 15.2-day median time-to-close and a 3-day 25th percentile; shipping is continuous (16 Studio minors Jun 11 – Sep 22, 2026, near-daily MCP server releases) and status incidents typically resolve in one to two hours with a public update trail. Not scored higher because the flagship counter-example is severe: the Portable Text data-loss bug shipped in v6.9.2 on Aug 11 and survived seven releases and five weeks before the v6.14.1 fix and npm deprecation on Sep 16, and the 75th-percentile issue close time is 97 days — so detection of quiet, serious defects lags the release cadence. Not scored lower because the eventual disclosure was exemplary, carrying a full root-cause writeup and explicit remediation steps.

The Visual Editing docs describe genuine page-building, not just field editing: the Presentation Tool lets editors add, move, remove and reorder content sections directly in the site preview, with drag-and-drop over array-based content, Overlays for visual representation and a useOptimistic hook for immediate feedback. @sanity/presets v1.0.0 (June 2026) ships a first-party definePage document type (content blocks + slug + SEO metadata) so the page-builder schema no longer has to be modelled from scratch. Two real caps remain: drag-and-drop must be wired into the frontend by a developer (it is framework-agnostic but not zero-config, and it is explicitly not supported on touch devices), and creating a genuinely new layout or section type is still a schema and component change. Marketers can assemble and rearrange pages from the approved block set independently; they cannot invent new ones.

Insights, built into the Dashboard with no setup, now includes a Releases panel that shows what is scheduled when — a forward-looking publishing timeline intended to catch launch conflicts, which is the closest thing Sanity has to a campaign calendar. Scheduled Drafts (single-document scheduling) are included on Growth and Enterprise; Content Releases, the multi-document staged-and-scheduled publishing feature, is a paid Enterprise add-on and not available on Growth at all, with rollback and overlapping-release preview gated further. A first-party developer guide shows building and sending Klaviyo email campaigns from Studio via two Functions, but that is a code recipe, not campaign tooling. There is still no campaign object, no campaign analytics, no multi-channel campaign coordination UI and no campaign lifecycle management.

SEO acquired its first first-party building block this year: @sanity/presets ships defineSeo (title, description, Open Graph image) and definePage bundles SEO metadata into the page type, so meta modelling is no longer purely a community-plugin or hand-rolled job — though the package is labelled experimental at v1.0.0 and APIs may change. The slug field type remains built in. Everything downstream is still the frontend's problem: the docs discuss sitemaps only as something you generate yourself in Next.js (with a warning to strip stega characters from generateMetadata and sitemap.ts), there is no redirect management, no SEO validation or scoring, no Schema.org structured-data helpers and no canonical URL management in the platform.

No native form handling, CTA delivery, conversion tracking, lead capture or UTM awareness. @sanity/presets adds a defineCta schema preset, but that models the content of a call-to-action, not its behaviour or measurement. Functions can process form submissions server-side and the Klaviyo guide shows outbound email, but every performance-marketing capability is still a custom build or a third-party tool.

Content Variants is Sanity's first native personalization primitive: a variant definition carries condition key/value pairs (audience: loyal, market: eu), variant documents hold the alternative content, and the Content Lake resolves the right version at query time on the same perspective machinery as Content Releases — no second API in the request path, and unvaried documents fall back gracefully. Editors get a single document with an 'All users' picker. The limits are substantial: it is beta, served only by the experimental 'X' API version, gated per project behind a feature flag whose current wave Sanity says is full, conditions are exact string matches with no ranges or boolean logic, and scheduled publishing is disabled while a variant is selected. Crucially, Sanity's own framing is 'your CDP decides who the visitor is, Sanity decides what they see' — there is no audience segmentation, behavioural targeting or geo-targeting engine here. The @sanity/personalization-plugin plus LaunchDarkly/GrowthBook/Croct integrations remain the production path today.

Content Variants is a better fit for experimentation than for personalization: each test arm is a variant definition (experiment: hero-a/hero-b/hero-c), variants are created only on the pages a test touches, and the frontend passes the assigned arm with its normal query. That removes the document duplication that made multi-arm content tests painful. Variant content can also sit inside a release so an experiment ships on schedule. But it is beta with a closed access wave, and Sanity supplies none of the experiment machinery that matters for a decision: no traffic allocation, no statistical significance, no auto-winner, no reporting. Assignment and measurement stay with GrowthBook, LaunchDarkly, Croct or Uniform, which is still where the @sanity/personalization-plugin path lands too.

The AI content-operations surface is now genuinely broad: Canvas for schema-aware AI drafting, Agent Actions for bulk operations, Content Agent in Dashboard, Slack and API, Agent Context, and an MCP server shipping near-daily (v2.35.3 on 23 Sept 2026) that Sanity says handled 1.2M tool calls in August from about half its enterprise customers. Insights surfaces work-in-progress and never-published drafts so stalled work is visible without asking. @sanity/presets removes schema boilerplate for the most common page patterns, and Workflows (beta, free for now) lets routine steps auto-advance while people hold the judgement calls. Against that, 2026 also cost teams time: Studio 6.9.2 through 6.14.0 were deprecated for a Portable Text data-loss bug, forcing an unplanned upgrade, and new page layouts still require a developer.

Structured content plus GROQ and the CDN remains one of the strongest channel-agnostic delivery layers in the headless field: model once, render per channel, with Portable Text carrying channel-specific renderers. The Klaviyo guide demonstrates the email channel driven directly from Studio content via Functions. Agent Context and the Knowledge Bases MCP endpoint extend delivery to AI agent channels — a real and growing channel class rather than a positioning claim, given Sanity's own MCP call volumes. Delivery to social, SMS and push still requires the customer to build the renderer and the send path; Sanity provides the content, not the channel adapters.

Insights is a real product page and a real Dashboard app, not a marketing label: WIP drafts, upcoming releases, most-active document types, documents published in the last four weeks, and a Last Updated view for stale content — no setup required. All of it measures the editorial operation, not the audience. Sanity Context Insights (moved from a Studio plugin into the Context app in September 2026) classifies AI agent conversations for success score, sentiment and content gaps, which is audience-facing but only for the agent channel. GA4, Adobe Analytics and Mixpanel remain ordinary frontend tagging with no CMS-side dashboard, and no page-level engagement or content-decay signal for web reaches Studio. Resonance, a Sanity Labs content-auditing tool that grades pages through a modelled audience's eyes, is early access only and too immature to credit.

Consistency is structural, not visual. Schemas constrain what editors can enter, custom roles and field-level filters restrict what they see, and @sanity/presets gives teams a canonical set of page, link, CTA, image and rich-text types to standardise on. None of that governs appearance: there are no locked style tokens, no approved component palette with enforced usage, no design-token store and no brand review gate. Whether a page comes out on-brand depends on how tightly the frontend implements the block set, not on anything the platform enforces.

The defineSeo preset makes an Open Graph image a first-party modelled field rather than something every team hand-rolls, and community plugins extend meta tag management further. Beyond the meta layer nothing exists: no social preview card rendering or validation, no social scheduling or push-to-social workflow, no UGC embed management and no social proof widgets. This sits squarely in the 'basic OG meta management only' band.

Media Library matured substantially through 2026 and is now a credible DAM: a nested folder hierarchy with shortcuts so one asset can sit in several folders (with automatic shortcut cleanup on delete), Aspects for structured custom metadata, asset versioning with per-version delete, an in-use table that names every referencing document and now its dataset, real-time presence showing who is looking at or editing what, private assets with signed URLs, bulk import with aspect categorisation, and a search Location facet scoped to folders. Video is real too — stored originals, static renditions and subtitles. Two things keep it short of a marketing DAM: it is an Enterprise add-on (Free and Growth get only the legacy media browser plugin), and there is no rights or licence management, usage-rights expiry, or approval state on assets.

Localization is unchanged and still plugin-based: @sanity/document-internationalization for document-level locales, sanity-plugin-internationalized-array for field-level arrays, Phrase and Weglot for TMS, Agent Actions for bulk machine translation. Notably, Sanity states outright that Content Variants are not localization — market can be a condition, but translation stays with the plugins and 'a first-party localization primitive is separate future work'. There are still no transcreation workflows, no market-level campaign scheduling, and no regional compliance tooling; Sanity's own guide says cookie consent belongs entirely to the frontend.

Functions (event-driven plus Scheduled Functions, with per-plan frequency from daily on Free to every minute on Enterprise) are a solid integration substrate, and Sanity now publishes first-party developer guides for concrete MarTech targets — Klaviyo email campaigns authored and sent from Studio, and an Algolia sync Function. Blueprints define functions, webhooks and roles as code, and Durable Functions (announced, not shipped) promise retrying multi-step chains. But guides are not connectors: there is still no pre-built Marketo or Pardot integration, no CDP connector, no ad-platform integration, and the HubSpot and Salesforce CRM options remain community listings on the Exchange rather than maintained first-party apps.

Product content sync got materially deeper in 2026. Sanity Connect for Shopify now imports metafields on products and collections as a typed store.metafields array keyed by namespace.key with values deserialized into real arrays, objects and numbers — so care instructions, specs and size charts are queryable in GROQ next to the rest of the product — plus variant-level fields like store.barcode. The new Salesforce Commerce Cloud connector brings the B2C catalogue across with read-only commerce fields (ID, name, prices, variants) alongside editable editorial fields, across multiple locales. Media Library handles per-SKU media with structured Aspects and usage tracking. What is still missing is PIM apparatus: no variant matrix UI, no attribute management interface, no product relationship or taxonomy tooling beyond generic references.

No merchandising features at all — the word does not appear anywhere in Sanity's documentation. No category merchandising UI, no promotional scheduling tooling, no cross-sell or upsell management, no search merchandising and no content-driven product discovery controls. Everything is handled by Shopify, SFCC or commercetools, or built from scratch. Expected for a content platform.

Sanity now has two first-party commerce connectors rather than one. Sanity Connect for Shopify is mature — bi-directional sync with metafield/metaobject write-back, real-time webhook and bulk syncs, out-of-order event protection via store.shopifyTriggeredAt, correct handling of unlisted products, and support for both Liquid Online Stores and Hydrogen/Oxygen — backed by Shopify's strategic investment. Sanity Connect for Salesforce Commerce Cloud reached v1.0.0 in April 2026: an int_sanity_connect cartridge running inside B2C Commerce with FULL and DELTA export jobs on the SFCC Jobs framework, plus an @sanity/sfcc Studio plugin supplying schemas, structure panes, document actions and UI, targeting PWA Kit or any framework. commercetools and BigCommerce remain available. The ceiling is architectural: both connectors move catalogue and editorial content, not pricing, cart or inventory state, and SFCC sync is scheduled batch rather than real time.

Editorial commerce remains a genuine Sanity strength. Portable Text with inline product references and the Shopify product picker in Studio make lookbooks, buying guides and shop-the-look a first-class authoring pattern, and the SFCC plugin adds equivalent structure panes and document actions for Salesforce catalogues. Portable Text also gained built-in table editing in Studio v6.6.0, useful for spec and comparison blocks inside editorial. Canvas drafts editorial copy against the same schemas. Purchase CTAs and add-to-cart behaviour are still rendered by the frontend — Sanity models the reference, the storefront makes it shoppable.

Nothing in Sanity injects CMS-managed content into transactional flows. Trust badges, shipping callouts, cart upsell banners and post-add modals are not manageable from Sanity without a full custom headless checkout build, and neither the Shopify nor the SFCC connector reaches the cart or checkout surface — both stop at catalogue enrichment. Commerce platform templates own the checkout.

There is still no CMS-managed post-purchase layer tied to order events — no order confirmation content model, no delivery tracking pages, no onboarding sequences, no review solicitation. The one adjacent development is the first-party Klaviyo guide, which shows Functions composing and sending customer emails from Studio content; a team could extend that pattern to order-triggered messaging, but Sanity documents it for marketing campaigns, not transactional or post-purchase flows, and the trigger would still be a custom commerce webhook.

Access control for content gating got stronger with User Attributes — SAML-sourced key/value pairs referenced in GROQ document filters via user::attributes(), so a role can scope content by branch, market or business unit and fails closed when an attribute is missing. But this governs which editors can see which documents, not which buyers can see which catalogue. There is still no customer-specific pricing display, no quote-request flow, no account-based content segmentation and no gated catalogue tooling, and the new Salesforce connector targets B2C Commerce specifically. B2B content patterns remain entirely custom.

The content-side search story improved on two fronts: Sanity now documents GROQ search patterns covering both BM25 ranking and embeddings-based semantic similarity, with semantic search and embeddings generation included on every plan, and publishes a first-party guide for an Algolia sync Function to keep an external index current. Knowledge Bases (beta) builds a fact-mapped, contradiction-checked index over a dataset plus owned URLs and files and exposes it as an MCP endpoint, which serves AI-agent discovery well. What is still absent is everything a storefront search team needs from the CMS: no end-user search UI, no synonym or rule management, no search landing page authoring and no blended content-product result surface — the frontend and a dedicated search platform own all of it.

Scheduled Drafts (Growth and above) activate promotional content at a set time, and Studio v6.15.0 added the ability to pause a scheduled draft — a small but real operational control for promos that slip. Content Releases coordinate sale launches across many documents with rollback, but are an Enterprise-only add-on. Insights' Releases panel gives a forward view of what publishes when, helping avoid overlapping promotions. Scheduled Functions add cron-driven activation and deactivation for developer-built logic. Still nothing purpose-built: no countdown timer component, no promo code messaging, no channel-specific promo targeting and no tiered pricing table authoring.

The multi-dataset pattern still suits multi-storefront well: shared product content centrally, cross-dataset references pulling it into storefront datasets, Media Library assets shared across datasets with usage now reported per dataset, per-storefront editorial and legal content isolated, and Studio workspaces giving each storefront team its own view. The SFCC cartridge syncs multiple locales in one job configuration. Two qualifications keep this mid-band: cross-dataset references are an Enterprise-only feature, so the shared-product-content pattern is unavailable below Enterprise, and the setup is documented rather than zero-config — each storefront still needs its own workspace and configuration.

Media handling for commerce improved noticeably. The image pipeline covers resize, crop, focal point and format conversion on all plans. Media Library now stores original video files alongside static renditions, supports video subtitles, video asset versioning, private video with signed URLs, PDF previews for spec sheets, and per-asset usage tracking so a swapped hero image propagates to every referencing document. Cloudinary integration remains for advanced transformation. Still no 360-degree product spins, no AR or 3D model handling, and no image hotspot commerce — those need a third-party media service and a custom frontend.

No marketplace features. Workflows (beta) is the one new primitive that moves the needle at all — stages, actors and guards could express a seller-submission moderation queue with a queryable audit trail — but that is a framework for building moderation, not moderation tooling. There are no seller profile types, no review aggregation, no content quality scoring at marketplace scale and no seller portal. Building this on Sanity remains a large custom project.

Commerce localization is better served than general localization because the connectors carry it. The SFCC cartridge exports categories and products per locale and the @sanity/sfcc plugin requires sanity-plugin-internationalized-array, so synced store fields arrive as internationalizedArrayString/Text types ready for locale-specific editorial enrichment — localization is part of the integration rather than bolted on afterwards. Shopify-synced products localize through the same document-internationalization plugin as everything else. What is absent is regulatory and commercial specificity: no currency-aware content blocks, no EU product label or CA Prop 65 tooling, and no market-specific promotional calendar.

Nothing connects content engagement to commerce outcomes inside Sanity. Insights measures the editorial operation — drafts in flight, document types by activity, what published in the last four weeks — not revenue. Sanity Context Insights scores AI agent conversation quality and sentiment, not attributed sales. There is no revenue attribution to content pages, no content-assisted conversion tracking and no product content performance view; all of it lives in Shopify, SFCC or an external analytics stack and never surfaces in Studio.

Editor-side access control is now genuinely strong. User Attributes (May 2026) attach key/value pairs to users — captured automatically from SAML assertions on every SSO login, or set manually by admins — and roles reference them in GROQ content filters via user::attributes(), so one parameterized role covers every branch, department or market instead of a role per permutation, and a missing attribute denies access by default. Custom roles with document and field-level filters, the Access API for org-level role management, and SAML SSO round it out. Two limits hold the score below the audience-visibility band: all of this (custom roles, User Attributes, SSO) is Enterprise-only, and none of it governs what content consumers see — reader-side audience visibility for an intranet is still a frontend authorisation problem.

Three 2026 additions push this up. Workflows (beta) finally gives knowledge updates a defined review path — stages, actors, guards and a state that lives in the Content Lake, so 'what got published without review' is a GROQ query. Knowledge Bases (beta) ingests a dataset or subset plus owned URLs and files, builds fact sheets into an outline, and surfaces contradictions between sources — directly useful for a knowledge base that has drifted. Insights' Last Updated panel surfaces articles nobody has touched in a given period. Retrieval is strong via GROQ with BM25 and semantic search. Still missing: knowledge base templates, archival workflows, content expiry and any knowledge-specific editorial UX — the modelling and the frontend remain a custom build.

Sanity is not built for employee-facing portals and nothing in 2026 changed that. There is no news feed for end users, no notification system for employees, no employee directory, no mobile intranet app and no personalized employee dashboard. Studio, Dashboard, Insights and Media Library all serve content editors. A real intranet front end is entirely custom work.

Company news and announcements can be modelled as document types, and Functions can push a Slack or email notification when one publishes. Nothing beyond that exists: no read receipts (the phrase does not appear in Sanity's documentation), no acknowledgment tracking, no mandatory-read workflow, no department-level audience segmentation for comms delivery and no employee notification surface. Everything an internal comms team measures on would be custom-built.

An employee directory is straightforward to model as documents with name, role, department and photo, and User Attributes could carry department or location for editors — but that is identity for permissions, not a directory. There is no org chart visualization anywhere in the product, no Workday or BambooHR integration, no skills or expertise search and no directory template. The modelling primitives exist; the purpose-built tooling does not.

Workflows is the first real approval mechanism Sanity has shipped for this: stages a document moves through, actors and guards deciding who or what can advance it, enforcement defined alongside the content, and workflow state stored in the Content Lake so an auditor can ask 'what got published without legal review' as a GROQ query — with the same permissions and audit trail whether a person clicks Approve or an agent calls the API. Version history and Compare versions cover the revision trail, though complete history and the full audit trail and History API are Enterprise-only (Growth keeps drafts history for 90 days). It is still beta on a 0.x stack with enforcement the Content Lake does not yet apply, and there is no acknowledgment tracking, no automated review or expiry reminder and no compliance-specific document controls.

Onboarding material — role guides, FAQs, reference docs — models fine as content types, and Workflows could in principle sequence an internal editorial process, but nothing addresses the learner. There is no progressive disclosure, no 30/60/90-day content path, no task checklist, no HR-triggered new-hire portal and no onboarding journey template. The delivery experience is entirely a custom frontend plus custom scheduling.

Knowledge Bases is the first Sanity feature that reaches across sources: you add a Sanity dataset or subset, website URLs you own and files, and it builds fact sheets into an outline with contradictions between sources surfaced — then exposes it as an MCP endpoint any connector-capable agent can query. That is federation of a kind, and the contradiction detection is unusual. But it is beta, admin-enabled, and aimed at agents rather than employees: there is no end-user search UI, no connector for SharePoint, Confluence or Drive, no faceted filtering for readers, no relevance tuning console and no search analytics. Studio's own groq2024 search, BM25 ranking and semantic search serve editors and developers, not intranet users.

Studio is a responsive web app built for desktop editorial work, and Sanity's own visual editing docs note drag-and-drop page building is not compatible with touch devices — a fair signal of where the editing experience is aimed. There is no native mobile app for content consumers, no offline support, no push notifications to end users, no kiosk or shared-device mode and no low-bandwidth optimisation. The APIs could power a custom mobile intranet, but that is a full app build.

No LMS integration and no micro-learning capability. Training content can be hosted as structured documents, but there is no course assignment, no completion tracking, no certification management and no connector to Cornerstone, Workday Learning or any other LMS. Sanity's own certification programme is for Sanity practitioners, not a feature customers can use for their own training.

Collaboration in Sanity is editor-to-editor and got richer in 2026 — real-time co-editing, comments with @mentions, tasks, and Media Library presence avatars showing who is viewing an asset, folder or field. None of it touches content consumers. There are no reactions on published content, no forums, no polls or surveys, no peer recognition, no idea submission and no community spaces. An employee engagement layer is a fully custom frontend.

Content Agent in Slack, included on every plan, is a real first-party workplace presence — teams run content operations conversationally from Slack rather than opening Studio. Knowledge Bases exposes an MCP endpoint that any connector-capable agent framework can consume, which widens where Sanity content can surface. Functions push event-triggered webhooks to Slack or Teams. But there is still no Microsoft Teams bot, no Google Workspace embedding, no embedded content cards for end users and no single-pane workplace experience; M365 integration remains a custom build, and the Slack surface serves editors rather than employees consuming content.

Insights turns out to be a more substantial lifecycle tool than a dashboard label: built into the Dashboard with no configuration, it reports work in progress including documents never published, a Last Updated view that surfaces documents untouched over a chosen period so teams can prioritise clean-up, document types ranked by activity for schema audits, and everything published in the last four weeks. That is real freshness visibility out of the box. Workflows adds stages a document must pass through, and Scheduled Functions make review-date sweeps practical to build. What remains absent is enforcement: no automated review dates, no stale-content flagging tied to ownership, no archival workflow, no expiry reminders, and no owner field the platform acts on. Lifecycle is observable now, but still managed by people rather than the platform.

Insights measures the people who make content, not the people who read it: drafts in flight, publishing activity by document type, recent publications, staleness. Nothing reports views by department, failed internal search terms, engagement heatmaps or adoption. Request Logs (Basic on Free and Growth, Advanced on Enterprise) can be exported to BigQuery for API and CDN traffic analysis, but those are infrastructure metrics, not intranet engagement. Measuring intranet ROI would mean instrumenting a custom frontend and building the reporting elsewhere.

Projects and datasets give hard isolation boundaries with independent content models, environments and API access, and Studio workspaces model several brands or markets in one Studio with tenant-specific views. Cross-dataset references and Media Library sharing provide controlled leakage across that boundary by design. Blueprints now define datasets, functions, webhooks and roles as versioned code, which makes standing up a new tenant repeatable. The counterweight is that Sanity has moved to an organization-centric model — Media Library, Functions compute and Content Releases are shared and billed at the organization level — and its own guidance for agencies is to create a separate organization per client to keep usage and billing clean, which means strict isolation and a unified cross-tenant view pull in opposite directions. There is still no single-pane multi-tenant admin console.

Sharing is npm-shaped and now has a first-party exemplar: @sanity/presets publishes ready-made page, link, CTA, image, SEO and rich-text types designed to be extended or replaced per brand, which is exactly the pattern teams were previously hand-rolling for internal schema packages. Cross-dataset references share actual content across brands, Media Library shares assets organisation-wide with per-dataset usage reporting, and the App SDK supports shared custom applications. Two constraints keep this mid-band: distribution is developer-driven through package versions, not something a content author can manage, and cross-dataset references are Enterprise-only. There is still no platform concept of a global template with brand overrides.

Governance took the largest single step of any item this cycle. Workflows makes the process itself a platform primitive: stages and decision rights defined in TypeScript, versioned and deployed like code, enforced identically whether a person clicks Approve or an agent calls the API, with state in the Content Lake so compliance questions are GROQ queries. User Attributes let a small number of parameterized roles govern a large organisation, resolving per user from SAML. Blueprints hold roles, datasets, webhooks and functions as code so a change is a reviewable diff. The Access API and org Dashboard centralise membership. The caps are real: Workflows is beta on a fixed 0.x stack with enforcement the Content Lake does not yet apply, workflow definitions are per project rather than organisation-wide, and there is still no cross-brand approval routing or global governance dashboard.

The organization-centric shift does create genuine pooling: Media Library, Functions compute and invocations, AI credits, embeddings and active Content Releases are all metered per organization, so a portfolio of brands under one organization shares those allowances rather than buying them per project. Shared schema packages and one Studio codebase cut per-brand build cost. Pulling the other way, seats and document quotas still scale per project, the features multi-brand work depends on — cross-dataset references, Media Library, Content Releases — are Enterprise-only or paid add-ons, and Sanity's own advice to agencies is to split clients into separate organizations precisely because pooled resources make cost attribution impossible, which forfeits the pooling. Meaningful multi-brand economics still require an enterprise negotiation.

Studio theming per project or workspace covers logo, colour palette and custom CSS, so each brand's editors work in a recognisably branded environment, and workspace-specific views limit them to relevant fields and document types. That is authoring-side theming configured by a developer, not self-service for a brand manager. On the delivery side the platform contributes nothing: what a visitor sees is entirely the frontend's design system, with no theme tokens, typography or palette managed at tenant level in Sanity.

The brand x locale intersection is still managed by convention rather than by the platform. Each project configures its own locale variants and TMS integration (Phrase, Weglot), and the SFCC cartridge handles per-locale catalogue sync within a project. Workflows could in principle express a per-brand translation approval chain, but definitions are per project so there is nothing routing Brand A's content to Brand A's translators from a central place. Sanity also states explicitly that Content Variants are not a localization primitive. There is no cross-brand locale governance view, no per-brand translation workflow configuration UI and no regional legal content governance by brand.

Insights lives in the organization Dashboard and is positioned as understanding 'what's happening across teams and applications', with document-type activity, WIP, recently published and a release timeline — so a portfolio owner does get one place to look rather than opening each studio. What Sanity does not document is per-brand breakdown or comparison: there is no brand dimension, no benchmarking of velocity or publishing cadence between brands, and no API for aggregate analytics across projects. Benchmarking Brand A against Brand B still means exporting and joining the data yourself, and agencies following Sanity's own separate-organization-per-client guidance lose even the shared Dashboard.

Workflows changes this item materially. A brand's publishing process is now a TypeScript definition deployed by CLI and versioned in the repository, so each brand can run a different approval chain, review stage set or automation level while the definitions sit side by side under source control and can be templated across brands the same way schema packages are. Because state lives in the Content Lake, a central team can audit every brand's process with GROQ — 'what got published without legal review' works across projects that share the pattern. Content Releases and per-project schemas still give brand-level autonomy, and Functions enforce brand-specific validation. It is beta, project-scoped rather than organisation-scoped, and Content Lake enforcement is not yet applied, so central audit is a query you write rather than a console you open.

Corporate-to-brand sharing works through cross-dataset references — press releases, legal disclaimers and product announcements authored once centrally and referenced by brand datasets — with Media Library providing the same for assets, now reporting usage per dataset so a central team can see which brands consume which asset. Functions can push content from a corporate dataset into brand datasets on publish. What is missing is the override model: a referenced document is used as-is, and letting a brand adapt syndicated copy while still receiving upstream updates is a custom pattern, not a platform feature. Cross-dataset references are also Enterprise-only.

The building blocks improved slightly. User Attributes carry location or market from the identity provider and deny access when an attribute is missing, so region-scoped editorial responsibility can be enforced rather than agreed; Functions validate required consent fields or legal disclaimers before publish; Workflows can make a legal stage mandatory; and Blueprints keep those rules as reviewable code. None of it is compliance tooling: Sanity's own guide states cookie consent operates entirely on the frontend layer and must be implemented there, there are no accessibility checks, no GDPR consent enforcement in the authoring layer and no data residency controls per brand. Every guardrail is one a customer writes.

@sanity/presets makes the federated-schema pattern first-party: a versioned npm package of common content types created once through a registry and explicitly intended to be extended or swapped per brand. Combined with shared Studio components distributed the same way, and Blueprints holding schema configuration as code, a central team can maintain a core library that brands build on. The mechanics are still npm mechanics — versioning, update propagation and brand-by-brand upgrades are the developer's job, the presets package is labelled experimental at v1.0.0, and there is no design system management UI, component versioning dashboard or visual design token store anywhere in the platform.

User Attributes are the meaningful change here. A user's location, department or language arrives from SAML on every login and refreshes automatically, roles reference those attributes in GROQ filters, and a small set of parameterized roles then governs every brand rather than a bespoke role per brand-permutation — with admin overrides for temporary reassignment and fail-closed behaviour when an attribute is absent. The Access API centralises org-level membership across projects, Blueprints define roles as code, and SAML SSO gives one login across brand Studios. It stays below the top band because administration is API and code driven with no unified cross-brand UI, roles and User Attributes are Enterprise-only, and a contributor spanning several brands still needs per-project membership.

Sanity's documented multi-tenancy approach — a canonical schema with tenant-aware fields, extended per brand only where necessary rather than forked — is now backed by a first-party package rather than only a recommendation: @sanity/presets creates base types through a registry that brands extend or replace type by type. Workspace-specific Studio views present brand-relevant fields without duplicating schemas, and npm versioning lets each brand adopt base-model changes on its own schedule. This remains a genuine architectural advantage over platforms that force a full model copy per brand. The gap is tooling: inheritance is expressed in code with no GUI for managing model lineage across brands, and drift between brand versions is a code-review problem.

Insights gives an organization-level operational view that did not previously exist in a usable form: unfinished and never-published work, a forward timeline of scheduled releases to spot conflicts across teams, document types by activity, recent publishing volume and stale content — all in the Dashboard with no setup. That answers some of what an executive would ask about content freshness and throughput. It stops well short of portfolio reporting: nothing breaks down by brand, there is no publishing SLA tracking, no cost allocation per tenant, no capacity planning and no export or aggregate API. Anything resembling an executive scorecard across brands still means building a custom analytics layer over the APIs.

Sanity republished its DPA on 12 August 2026 as a click-accept addendum binding on all tiers with no separate signature, and it now reaches beyond EU GDPR to UK GDPR (IDTA), the Swiss FADP (explicit Clause 17/18 modifications), and US state privacy law with a processor 'will not sell or share' certification; EU SCCs Module Two are incorporated with the docking clause and Irish governing law, a named DPO ([email protected]) is given, and Content Lake defaults to GCP Belgium. The public sub-processor register has grown from four entries to eleven, each with HQ address, EIN and location of processing, including a distinct Generative AI section. Not higher because sub-processor change notice is discharged merely by editing the page — the DPA puts the onus on the subscriber to 'subscribe to available update notifications' that the page does not offer — with a 10-day objection window whose only remedy is termination, and erasure remains API-driven with no DSR portal.

The healthcare positioning cited in the prior scoring is gone — sanity.io/healthcare and every /solutions/ and /industries/ variant now return 404, and the site's 'By Industry' nav lists only E-commerce & Retail, Media & Publishing and SaaS. The entire 5.2 MB documentation corpus contains zero whole-word occurrences of HIPAA, BAA, Business Associate or PHI, and the new DPA moves in the opposite direction by declaring sensitive data out of scope by default. HIPAA appears on the security page only inside the list of Google Cloud's audit standards, which per the anti-pattern does not transfer to the SaaS layer; scored just above the floor because GCP's HIPAA-eligible infrastructure and the DPA's 'unless expressly authorized by Sanity' carve-out leave a negotiated path theoretically open.

The August 2026 DPA widens coverage past the previous GDPR+CCPA baseline by adding an explicit Swiss FADP transfer module and a general US state privacy-law processor certification, on top of UK GDPR via the IDTA, a detailed CCPA/CPRA section with category-by-category 'we do not Sell or Share' charts and Shine the Light disclosure, and a Norwegian Transparency Act (Åpenhetsloven) due-diligence statement published as an annual Redegjørelse. That still leaves the regulated-vertical tier empty: no FedRAMP, IRAP, C5, HITRUST or ENS, and no LGPD or PIPEDA documentation anywhere. Scored at the top of the commercial-frameworks band, on par with Hygraph and below Contentful and Contentstack, which document broader regional programs.

Sanity holds a current SOC 2 Type 2 attestation, but the examination still covers the Security trust service criterion only — Availability, Confidentiality, Processing Integrity and Privacy remain out of scope — and the DPA points to the security page as the contractual statement of technical and organizational measures. Reports are available under NDA on an annual cadence covering Content Lake and the APIs. The single-TSC scope holds Sanity at the top of the 'Security TSC only' band and well below Contentstack (90) and Contentful (88); the fact that the security page has not been revised since 11 June 2025 gives no basis to credit a wider scope.

Sanity still holds no ISO 27001 or ISO 27018 certification of its own, and there is no published certification-in-progress statement. The security page enumerates ISO 27001, 27017 and 27018 strictly as audits Google Cloud Platform undergoes — infrastructure certifications that per the anti-pattern do not transfer to the SaaS layer — and the documentation corpus returns zero matches for ISO 27001. This remains the platform's clearest enterprise-procurement gap, in line with Strapi (38) and Directus (35) and far behind Contentful (80) and Contentstack (75).

Beyond SOC 2 Type 2 (Security TSC), Sanity holds no additional platform-level certifications — no CSA STAR, PCI DSS, Cyber Essentials Plus, FedRAMP, IRAP or C5 — and operates no trust-center portal (trust.sanity.io and sanity.io/trust do not resolve) and no bug bounty. Worth flagging a discrepancy that argues against any upward adjustment: the pricing comparison table advertises 'PCI DSS — Included' on all three plans, while the security page attributes PCI DSS Level 1 solely to Stripe as payment processor, which covers card handling rather than the CMS. Held at the base band for vendors without a broader portfolio.

Content Lake residency covers EU/EEA (GCP Belgium, the default primary) and the US, with enterprise customers able to negotiate contractually bound placement in other regions where Sanity operates, and the expanded sub-processor register now documents the full data-flow chain per vendor and jurisdiction. Two caveats hold this at the top of the EU/US binary band rather than higher: there is still no APAC region and no per-plan region selector on the pricing matrix, and the security page's promise of 'a fully global backend infrastructure, with customer-controlled data placement' remains a plan 15 months after that page was last revised. The register also newly discloses that AI features route input to OpenAI, Anthropic and Braintrust in the US — opt-in per the AI terms, but a genuine egress path for EU customers on top of the global CDN edge caches.

The August 2026 Terms of Service replaced the previously vague 'short grace period' with a contractual exit window: on request Sanity provides a copy of Subscriber Data in its standard export format within 30 days of termination and is not obliged to retain it beyond that, while the privacy policy commits to deleting or anonymizing logs within 90 days and removing an account's personal data within 90 days at the latest. Self-service export is genuinely complete and automatable through the sanity dataset export CLI (NDJSON) and GROQ, and erasure is available programmatically via the per-document history purge endpoint and immediate asset deletion. Not higher because right-to-erasure is developer-facing with no DSR portal for non-technical operators, and content revision history is hard-capped at 3 days on Free and 90 on Growth, so lower tiers cannot lengthen retention to meet a records obligation.

Audit tooling is better documented than the prior scoring credited: an Activity Log API shipped documentation in July 2026 covering user, organization and project scopes with pagination, filters and CSV export; the Activity Feed in Manage enumerates roughly 30 named team and project events (API tokens, CORS origins, permission changes, dataset create/delete, DPO and EU Representative changes) and exports to CSV with actor email, correlation and transaction IDs; and a free read-only Security tab added in September 2026 surfaces admin counts, non-expiring tokens, public datasets and SAML status. Enterprise projects additionally get continuous compressed NDJSON delivery to a customer-owned GCS bucket for BigQuery ingestion. Held below the 75 band because the pricing matrix gates 'Audit log: content changes and events' and 'Full audit trail & History API' to Enterprise only, the Activity Log API explicitly excludes content activity, self-serve request-log export is capped at 1 GB over 7 days with one export per 24 hours, and GCS is the sole delivery target with no native Splunk or Datadog connector.

Sanity remains one of the few headless vendors with a genuine WCAG-EM conformance review of its authoring UI, but the published statement still reports Sanity Studio as only partially conformant with WCAG 2.1 A+AA at 39 of 50 success criteria as of August 2022, and it names the unresolved blockers itself: missing text alternatives, no heading or landmark structure for screen-reader navigation, unnamed buttons, and an opaque Changes panel. Four years on there is no re-assessment covering Studio v5 or v6, though 2026 release notes do show continuing incremental fixes to keyboard navigation, menus and popovers. Actual conformance today is likely better than the record shows, but an evidence-based score cannot go above the 'dated formal report' band.

A dedicated accessibility microsite publishes formal VPAT/ACR documents built with the OpenACR editor alongside the full WCAG-EM conformance reviews, plus an accessibility statement linked from the site footer and a monitored [email protected] contact with a one-week response commitment — more than the page-only posture of most headless peers. But the newest VPAT is dated September 2022 and the microsite carries nothing from 2023 through 2026, so a procurement team asking for a current ACR covering Studio v5 or v6 cannot be served. No Section 508 conformance statement and no ATAG 2.0 assessment are published.

AI Assist (GA, Growth plan and up) provides schema-aware generation with reusable instructions and style guides; Content Agent (GA) executes writing, rewriting, summarization and bulk copy updates across the library, and is included on every plan including Free — AI is the rare Sanity capability that is not Enterprise-gated. Not higher because custom instructions cap at five per scope and the docs state they are 'guidance, not enforcement' with contradictions left unresolved, so brand-voice control is a steer rather than a guardrail.

Agent Actions ship a dedicated image generation/transformation surface documented at 'Create images with Agent Actions', and the Content Agent user guide documents background replacement, colour/lighting/composition adjustment, brand-style matching, hero-image concepting and social graphic generation in-document. Auto-generated descriptions for alt text and captions are configured declaratively via `options.aiAssist.imageDescriptionField`. Not higher because there is still no AI video generation and no AI media processing inside the Media Library itself.

Translate is a first-class Agent Action with its own quick start and cheat sheet, AI Assist translates whole documents or single fields retaining formatting, and Content Agent does bulk localization ('Generate [language] versions of all product descriptions') with published per-document-per-language credit costs. Not higher because there is no MT quality scoring, no translation memory, and brand-voice preservation across locales rests on the same non-binding custom instructions.

Content Agent bulk-generates meta descriptions and alt text for documents missing them, creates excerpt summaries for empty preview fields, and the Agent Toolkit ships a dedicated SEO/AEO skill targeting answer engines like ChatGPT and Perplexity; an official auto-tagging Function recipe generates and reuses taxonomy tags. Not higher because there is no on-page SEO scoring dashboard and no schema.org markup suggestion feature in the product.

Agent Actions (Generate, Transform, Translate, Patch, Prompt) are schema-aware APIs runnable in Functions, migrations and Studio; Content Agent does bulk field updates, term/URL replacement, orphaned-content detection and content-calendar generation, and can stage ops into scheduled Content Releases (e.g. redirect documents in a release dated to campaign expiry). Not higher because much of the lifecycle automation still requires a developer to wire Functions or Blueprints rather than no-code editor configuration.

Content Agent is GA across Dashboard, Slack and a public API, runs multi-step operations over hundreds of documents (web search, analysis, mutation, image generation) and enforces real gates: every edit stages as a draft in a reviewable bundle, and bulk runs require confirmation once the estimate reaches 100 credits or the org's remaining balance, with spending limits that halt AI entirely. Contextual awareness scopes answers to the open document. Not higher because there is no agent marketplace and no cross-agent orchestration between Content Agent and customer-built Context agents.

Content Agent surfaces stale content, orphaned/unlinked documents, missing fields, content gaps and answer-engine performance conversationally, and Sanity Context Insights (v2.0.0, Sept 2026) adds a genuine dashboard in the Context app with trends, success scores, sentiment and an extracted `contentGaps` list showing topics the agent lacked information on. Not higher because Insights measures agent conversations rather than the content estate itself, and there is still no always-on editorial content-health dashboard, topic clustering or ROI attribution.

The Content Agent guide now documents an explicit Accessibility audit dimension — images without alt text, media missing captions or transcripts, non-descriptive link text, illogical heading hierarchy — alongside QA passes for spelling/grammar, broken links, outdated pricing/dates and incomplete required fields, plus brand-tone review and standardisation across a document type. Audits run over hundreds of documents with a cost estimate first and results staged as drafts. Not higher because there is no quantified quality or brand-compliance score, only conversational findings, and the docs warn pattern matching misses cases needing editorial judgment.

Dataset Embeddings are GA on all plans with generation included at no cost, enabled on new or existing datasets via CLI/HTTP with optional projections, and queried natively in GROQ through `text::semanticSimilarity()` inside `score()`. Context MCP layers BM25 keyword, semantic and true hybrid search with selectable boosting over the same content, and Knowledge Bases pre-index datasets, websites and files as a served RAG index. Not higher because queries meter against a monthly semantic-search quota, keyword matching has no stemming or fuzzy fallback, and there is still no turn-key semantic search UI for editors.

Sanity now documents a first-party personalization pattern — the logged-in assistant gathers user signals from the CRM/commerce systems that own them and feeds them to the agent as context shaping catalog queries and ranking, with per-request `groqFilter` scoping and fail-closed base filters for user-owned documents. Not lower because embeddings plus this documented production pattern are real infrastructure; not higher because the docs are explicit that Sanity is not the profile store and personalization 'rides on top' — there is no ML personalization engine, audience scoring, predictive segmentation or next-best-content model in the product.

Two official hosted MCP servers: the read/write Sanity MCP server at mcp.sanity.io with OAuth and token auth, one-command CLI install (`sanity mcp configure`) and documented support for Claude Code, Cursor, VS Code, Lovable, Replit and v0; plus Context MCP, a separate read-only server with source scoping and GROQ filters. Release cadence is exceptional — v2.20 to v2.35.3 between June and September 2026, adding workflow authoring, asset upload from URLs, CLI command execution and session security hardening. Not higher because credit-consuming tools are not individually permission-scoped and rate-limit governance remains thin.

Sanity Context is fully BYOK and BYOM — you supply the model and an API key from Anthropic, OpenAI or another provider, you run the agent loop, and Insights classification runs 'on your side with your own AI SDK model'. Not higher because the editor-facing features (AI Assist, Content Agent, Agent Actions) are locked to Sanity-managed models billed in AI credits with no provider choice, no custom endpoint configuration and no AI data-residency controls.

Best-in-dataset developer AI surface, and the framework-integration gap that previously capped this item is now closed: official connection guides ship for LangChain (langchain-mcp-adapters), the OpenAI Agents SDK and the Vercel AI SDK. Alongside these sit a 24-page 'Build with AI' hub, the public Content Agent API, Agent Skills in the open agentskills.io format installable with `npx skills add sanity-io/agent-toolkit`, `sanity init` prompting to install MCP and best-practice skills, the @sanity/agent-directives package, an inline initial-context HTTP endpoint that removes a round trip, and Knowledge Bases. Not higher only because there is no CrewAI or LlamaIndex guide and no first-party evaluation harness.

Human-in-the-loop is genuinely enforced — every Content Agent edit stages as a draft bundle, bulk runs above 100 credits require confirmation, the agent respects role permissions, and Context MCP is read-only with org-token auth, source scoping and GROQ filters. Org- and user-level custom instructions add brand steering, and Enterprise adds audit logs and the Activity Log API. Not higher because Sanity's own docs downgrade custom instructions to 'guidance, not enforcement' with contradictions explicitly unresolved, and there is no hallucination detection or confidence scoring, no AI-specific audit trail distinct from document history, and no IP indemnification for AI output anywhere in the documentation.

The Manage Usage tab reports org-wide AI credits split by Agent Actions, Content Agent Queries and Content Agent Actions with daily trend charts and a per-user leaderboard, credit pricing is published at $0.05 with worked per-task estimates, and admins set spending limits that pause AI at the cap. Context Insights adds quality trend monitoring for custom agents — success score, sentiment and content-gap trends over conversations. Not higher because Insights covers only developer-built Context agents, leaving Content Agent and AI Assist with no quality, model-performance or prompt-effectiveness analytics.