partner review posts and connection

README.md

@@ -266,6 +266,35 @@ every boot; it
 You never have to click through the Users & Permissions screens after adding a content type;
 restart the CMS and the grant is there.
 
+### Partner content review
+
+Partner contributors use Strapi's **Author** admin role. To onboard one, create the admin
+account, then as Super Admin create a **Partner Access** entry in Content Manager with the
+admin user ID (from the user detail URL) and the linked Partner organisation. Each admin
+account has one assignment; multiple accounts can be assigned to the same partner. Partner
+Access has no public Content API and is reserved for Super Admins.
+
+Authors can create and edit their own resource, news article, activity, event, or opportunity
+drafts. The CMS enforces their partner assignment on every save, regardless of what the
+browser submits, and removes the organisation selector from their edit fields. Authors cannot
+publish or delete. An **Editor** reviews the draft in the side panel below Preview. Set its
+status to **Approved for publishing** before publishing, or choose **Changes requested** or
+**Rejected** and add feedback. The Publish action stays disabled until approval is saved, and
+the server rejects publish requests for these content types unless their review status is approved.
+The partner author can read the status and feedback in the CMS; both fields are excluded from the public API.
+Resubmitting resets the status to **Pending** and clears old feedback.
+
+The CMS also emails reviewers when a partner draft is first submitted or resubmitted, and emails
+the submitting admin when the reviewer requests changes, rejects the draft, or publishes it.
+Reviewer mail goes to all active Super Admins by default; set the optional comma-separated
+`PARTNER_REVIEW_NOTIFICATION_EMAILS` to use a dedicated inbox. These notices use the configured
+SMTP provider. Email failures are logged and do not undo a saved draft or review decision.
+
+Strapi's built-in Author role limits authors to entries they created. Different users assigned
+to the same partner therefore share the organisation assignment, but not each other's drafts.
+Use Editor for central review; partner-wide collaboration would need a separate custom access
+policy.
+
 ### 6. Create the first admin user
 
 Strapi has no seeded administrator. On first run, open
@@ -901,6 +930,7 @@ Whichever port you pick, `SITE_URL` stays the public origin (`https://sharper.ly
 | `STRAPI_URL` | web | the CMS origin, e.g. `https://cms.sharper.ly`. It is also prefixed onto media URLs, so it must be resolvable **by the browser**, not only from the server |
 | `STRAPI_TOKEN` | web | only needed for draft/protected content; published content is public |
 | `PUBLIC_URL` | cms | `https://cms.sharper.ly` — admin redirects and generated links |
+| `PARTNER_REVIEW_NOTIFICATION_EMAILS` | cms | Optional comma-separated addresses for partner draft notices; defaults to active Super Admins |
 | `IS_PROXIED` | cms | `true` behind nginx / a load balancer, so `X-Forwarded-*` is trusted |
 | `CORS_ORIGINS` | cms | `https://sharper.ly,https://www.sharper.ly` — an empty list blocks every cross-origin browser call, which is the safe default |
 | `DATABASE_*` | cms | managed PostgreSQL; set `DATABASE_SSL=true` for a hosted database |