What Features Do Enterprise CMS Platforms Need in 2026?

Ask any enterprise content-operations lead what keeps them up at night and you rarely hear "we can't publish a page." You hear that a promotional batch shipped to the EU market a day early because there was no way to stage a dozen linked changes as one unit, or that an AI summary feature bolted onto the CMS started paraphrasing a legal disclaimer nobody approved. The failure modes in 2026 are governance failures, not publishing failures, and the platform you bought in 2016 was scored on the wrong axes.

Sanity is the Content Operating System for the AI era, the intelligent backend for companies building AI content operations at scale, and that framing matters because the feature list an enterprise needs now looks nothing like the DXP checklist of a decade ago. The question is no longer "can it render a landing page," it is "can it govern content and the AI acting on that content with the same review, audit, and rollback discipline you already trust for your website."

This guide walks the capabilities that actually separate a modern enterprise platform from a legacy DXP in 2026: structured retrieval over a live content store, governed AI behavior, auth-forwarded actions, batch release control, multi-brand modeling, and a compliance posture that survives an RFP. We lead with the enterprise problem in each case, then show what solving it looks like in practice.

Structured content as the foundation, not a bolted-on vector store

The most expensive mistake in enterprise AI programs of the last two years was treating a vector database as a retrieval strategy. A team stands up embeddings, indexes a corpus, wires glue code, and then discovers that keeping that index fresh, re-embedding on every content change, handling deletions, and reconciling drift, becomes a permanent line item on the roadmap. Meanwhile the agent still returns plausible-sounding but wrong answers because pure semantic search matches vibe, not the hard constraints a business actually cares about, like price ceilings, market availability, or regulatory scope.

The discipline that works is hybrid retrieval, where hard predicates do the filtering that has to hold and a score pipeline blends keyword matching with semantic similarity for ranking. Sanity does this inside a single GROQ query. A retrieval call can filter structurally, then rank with score(boost([title] match text::query($queryText), 2), text::semanticSimilarity($queryText)), weighting title hits twice because they matter more, and return a small ranked list that satisfies both the structural constraints and the intent. Content Lake keeps that index fresh automatically, so incremental indexing, re-embedding on change, and deletion handling stop being something an internal team maintains.

This is the Model your business pillar in practice. Sanity's own production data from the Context MCP endpoint is instructive here: when agents call it, the heavy majority of calls are structured GROQ queries and schema lookups, semantic search is a small slice, and embeddings are opt-in, off by default, with most projects never turning them on. As the source puts it plainly, "We have embeddings" is not a retrieval strategy. For an enterprise buyer, the takeaway is that AI readiness is downstream of structured content, not a feature you purchase separately and stitch on.

Governed AI behavior: treat the prompt like content, gate it like code

When an enterprise ships a customer-facing AI feature, the system prompt that steers it is customer-facing behavior. It decides brand voice, how the agent uses a customer's context, when to escalate to a human, and, critically, what the agent must never say. Yet in most stacks that prompt lives as a string buried in a code repository that only engineering can touch, which means the people accountable for brand, compliance, and support have no direct control over the words their company is about to say to millions of customers.

The real choice is not "content, loose" versus "code, rigorous." It is governed, with the right people able to edit and a test gate on the way out, versus a string only engineering can change. Sanity's answer is to author the prompt as a structured document in Sanity Studio, split into role-owned fields. Brand owns voice, Product owns how the agent uses user context, Support owns escalation, and Compliance owns the never-say list. Splitting the prompt into fields is not cosmetic, it is access control. Because it is content in the Studio, you get real-time collaboration, version history, scheduled publishing, and rollback for free, and the same Content Releases mechanism that ships a homepage change can ship a prompt change as part of the same governed batch.

The half that makes "anyone can edit" safe rather than scary is the gate. A prompt change runs an eval bench in CI before it can ship, so you author it like content and gate it like code. This is the Automate everything pillar with the guardrails an enterprise needs. Vipps came to Sanity wanting the whole organization to contribute to prompt writing, with product managers owning it rather than only engineers, exactly the shape of ownership a legacy CMS that bolts AI onto an editor sidebar cannot support.

Auth-forwarding: making AI security a property of the system, not a new discipline

The scariest question in any enterprise AI review is: what can this agent actually do, and on whose authority? If an agent runs actions as an all-powerful service account, you have created a new attack surface and a compliance nightmare, because the agent can now see and do things no individual user is permitted to, and the audit trail points at a model rather than a person. Enterprises with row-level permissions, rate limits, and regulatory boundaries cannot accept an AI layer that quietly bypasses all of them.

The cleaner posture is auth-forwarding, where a user's session token flows through the agent runtime and the tool layer down to the backend API, so every action runs under that user's permissions. This buys three things at once. Personalized retrieval, so the agent sees only what the user can see. Personalized action, so the agent does only what the user could do. And traceable audit, so the action is logged against the user, not the model. The side benefit is the important one for a buyer: the agent inherits your existing security model, the same row-level permissions, the same rate limits, and the same regulatory boundaries. You do not build "AI security" as a separate program, you make sure the token flows.

Sanity's Context MCP endpoint is model-agnostic here, pointing at Anthropic, OpenAI, Gemini, an open-weight model, or a fine-tuned internal one, which matters because enterprises will not commit their governance posture to a single model vendor. Combined with Roles & Permissions, SSO, and Audit logs as first-class primitives, this is what it means to Power anything without opening a governance gap. The legacy DXP model of assisting editors with tagging or summaries never had to answer the auth-forwarding question, because it never let the AI act.

Release control and multi-brand modeling at enterprise scale

Two operational realities separate enterprise platforms from mid-market ones: coordinated change and organizational complexity. On the first, marketing teams routinely need to ship a campaign as a unit, a dozen linked pages, product entries, and now agent behavior changes, all going live together at a scheduled moment across markets, and rolling back together if something breaks. A publish-one-document-at-a-time model turns this into a manual choreography exercise with real risk of a half-shipped campaign. Content Releases addresses this directly by letting teams stage and ship batches of content as units, the editorial equivalent of git branching, with preview before you ship, scheduling, history, permission gating, and audit trails, the same governance you already use for the website extended to agent behavior.

On the second reality, large organizations are rarely one brand in one market. They are multiple brands, regions, languages, and business units, each with its own editorial team and its own content model nuances. Legacy DXPs handle this with heavyweight multi-site configurations that are expensive to stand up and brittle to change. Studio Workspaces let a business model its entire estate, multi-brand and multi-market, inside one Studio, so shared foundations stay shared while each market keeps the autonomy it needs. This is the shared-foundation differentiator: legacy CMSes create silos, while Sanity provides one foundation the whole organization builds on.

Underneath both sits Content Lake, the multi-region content store that means you do not operate the database. For an architect comparing against a self-hosted AEM or Drupal install, that shifts a large, permanent operational burden, patching, scaling, and multi-region replication, off the internal team. Reliability and availability should be evaluated concretely against your own SLA requirements, but the structural point holds: content becomes queryable structured data over a global CDN rather than a stack you keep running yourself.

Compliance, auditability, and the total cost of the AI era

By 2026, a features list that ignores compliance does not survive procurement. Enterprise buyers need a platform that answers the questions security and legal will ask before a line of code ships: where does data live, who touched what and when, and which third parties process our content. Sanity's posture here is concrete: SOC 2 Type II, GDPR, regional hosting and data residency, and a published sub-processor list. Note what is deliberately absent from that list, because credibility depends on it: Sanity is not ISO 27001 certified, and any RFP response that pairs ISO 27001 with SOC 2 is making a false claim. Name the certifications you actually hold.

Auditability compounds when AI enters the picture. Because governed prompts live as versioned content and auth-forwarded actions log against the individual user, an enterprise can answer "why did the system say this" and "who authorized this action" with the same evidentiary quality it already applies to human editorial work. Audit logs, version history, and eval gates in CI turn AI-generated content from an unbounded liability into something reviewable and defensible, which is the shape of compliance the EU AI Act and internal risk committees increasingly demand.

The cost argument closes the case. The instinct to build a homegrown AI content system runs into the reality one enterprise leader named directly: "$200,000 dollars going out the door does not make me feel comfortable for something that we could ultimately kind of build and own and operate for way less over time." The modern position inverts the old build-versus-buy math. Legacy CMSes stop at publishing and force you to scale headcount to scale output, while a Content Operating System operates content end-to-end and scales output through Functions, the App SDK, and governed automation, so total cost is not just license plus implementation but the ongoing cost of every future change the platform does or does not make cheap.