Sanity — Workshop Pack · BMW·MINI CMS Evaluation

The day at a glance

A ~8.5-hour working session, structured around the eight non-negotiable gates. Every critical question is run as “show us”, not “do you support…”. The output of the day is evidence — recordings, logs, API responses — and a completed scorecard, not a feeling.

30m

Context: BMW/MINI + target architecture

Vendor confirms it understands the HQ→market model and the eight gates below.

90m

GATE 1 — Fallback / inheritance

Live demo: partial override + later HQ update. Capture CDA/GROQ payloads before & after.

90m

GATE 2 — Approval workflow

Demo in UI, then attempt publish with a Management-API token. Capture the enforcement response.

60m

GATE 3 — Editor visual preview

Real BMW-like preview: inherited vs overridden fields, market/locale, approval state.

60m

GATE 4 — DAM / AEM Assets

Asset reference, expiry/replacement, usage tracking, pre-publish stale-asset warning.

60m

GATE 5 — Migration / cutover

Environment model, re-runnable import, rate limits, rollback — with real 429/Retry-After logs.

60m

GATE 8 — Compliance / commercial / contract

Answers that go into the contract/RFP, not just the chat: SLA, residency, TISAX/ISO, uplifts.

45m

AI / personalization (Phase-1 scope only)

Only as far as BMW's Phase-1 scope requires — do not let it consume the day.

30m

Recap / open risks

Pass/fail per gate, open-risk owner + follow-up deadline, contractual to-dos.

Read-in: where Sanity stands going in

Our position from the documented evidence in the shared dossier (verified against official docs, two passes 2026-07-06/07). The workshop confirms or overturns it — that is the point.

Top strengths

Proven field-level inheritanceOur deployed Studio resolves HQ→market fallback per field via GROQ coalesce, chainable market→region→HQ — demonstrable live, today. docs
Schema-as-code + strongest modelingTypeScript schemas in git, arbitrary nesting to 20 levels, JS validation, native image hotspot/crop — no forced decomposition. docs
Cleanest content exitExport is all documents incl. drafts + assets, and Portable Text is a published open spec — the least lock-in on the content itself. docs

Top risks / where the bodies are buried

No native approval workflowPublish is a separately grantable permission (API-real), but the Draft→Reviewed→Approved state machine is our application code; the official plugin is advisory-only (UI-level, not API-enforced). docs
Governance is an Enterprise paywallCustom roles, SSO, Content Releases and the SLA are all Enterprise-only; permissions stop at the document level (no field-level); there is no published SLA %, no own ISO 27001, and no contractual EU region pinning. docs
Young, opinionated edgesAgent Actions are still labelled 'experimental'; GraphQL is second-class to GROQ (a skills/portability line item); cross-dataset references are Enterprise + same-project only and don't support the references() impact query. docs

Live demo scripts — the eight gates

Each gate is a script: setup → show-us steps → expected evidence → pass/fail. Run them in order; GATES 1 and 2 are the ones that decide Sanity. Don't accept a verbal answer where a demo is written.

GATE 1

Field-level HQ inheritance

90 min

Going in: Strong (proven custom) — we can run this ourselves; the ask is their recommended production shape.

Setup

Our deployed Studio: a car with a baseCar reference and a coalesce projection. A DE variant overriding price + description only.

Show us — live steps

Run the GROQ coalesce query for the DE market → returns DE values where set, HQ values everywhere else.
Change the HQ master price → re-run → DE inherits the new price; the DE overrides are untouched.
Show it is per-field and chainable (market → regional master → HQ) and works for any field type incl. images.
Run count(*[references($hqId)]) for impact analysis — and note the cross-dataset references() limitation for a multi-project topology.

Expected evidence to capture

GROQ results for each step (we can demo this live from the repo) + their recommended production pattern.

✓ Pass

The pattern holds per-field after partial override AND they endorse a maintainable production shape at 50+ models × 30 markets.

✗ Fail

The pattern only works single-project and can't scale, or impact analysis is infeasible.

Reference: official docs

GATE 2

API-enforced approval

90 min

Going in: Custom build — be precise about which half is platform-enforced and which half is our code.

Setup

A custom role where the market-editor lacks the publish permission; a workflowState field + a custom Studio document action that hides Publish until Approved.

Show us — live steps

As an editor without the publish grant, attempt to publish via the API → expect a 403 (this enforcement is real, at the API).
Show the custom document action gating Publish until workflowState == 'approved'.
State plainly: the state machine (transition order, who-moved-what, audit) is our application code — not a platform guarantee.
Ask what Sanity officially recommends for approval in 2026 (Content Releases have no approval gates; the workflow plugin is advisory).

Expected evidence to capture

The 403 response (API-level publish restriction) + an honest scope statement of platform vs. our code.

✓ Pass

Publish is genuinely API-restricted by role AND the custom state-machine effort is understood and accepted.

✗ Fail

The plugin is oversold as enforcement, or publish can't actually be withheld at the API.

Reference: official docs

GATE 3

Editor-grade visual preview

60 min

Going in: More of the experience is ours to build — which means it can render inheritance badges exactly as BMW wants.

Setup

The Presentation tool / Visual Editing wired to a BMW-like frontend with click-to-edit.

Show us — live steps

Open Presentation; click an element in the live preview → jump to its field in the Studio.
Show a custom badge marking inherited-from-HQ vs. locally-overridden fields (our Studio customization).
Show approval state + market/locale in the same view.

Expected evidence to capture

A recording of click-to-edit + the inheritance/approval badges.

✓ Pass

Inherited/overridden + market/locale + state visible; the custom build effort is understood.

✗ Fail

Visual editing needs a framework we won't use, or inheritance visibility isn't feasible.

Reference: official docs

GATE 4

DAM / AEM Assets coexistence

60 min

Going in: Native hotspot/crop; Media Library is Enterprise; asset references straightforward.

Setup

An image with hotspot/crop + an external/stale asset scenario.

Show us — live steps

Show the image URL builder applying hotspot/crop automatically from stored focal points.
Reference an external asset and show usage tracking via GROQ references().
Discuss expiry/replacement + Media Library (Enterprise) for cross-project assets.

Expected evidence to capture

Working hotspot/crop + a usage-tracking query; Media Library plan gating.

✓ Pass

Focal-point delivery + a usage/expiry story (native query + bounded build).

✗ Fail

No expiry/rights model and CMS store pushed as the DAM.

Reference: official docs

GATE 5

Migration & cutover

60 min

Going in: 25 req/s mutations per IP (parallelizable — confirm); validation runs only in Studio, not on API imports.

Setup

An NDJSON export/import between datasets; a bulk import script.

Show us — live steps

Run dataset export → import into a fresh dataset (tarball with assets) → show idempotent re-run via --replace.
Sustain mutations at 25 req/s from one IP, then from several → confirm whether it parallelizes across IPs (get it in writing).
Key risk: show that API imports bypass Studio validation — and demonstrate the pipeline re-validation step (our dry-run already does this).

Expected evidence to capture

Import logs, the per-IP rate behavior, and a validation-on-import strategy.

✓ Pass

Idempotent import + a parallelization answer + a validation-enforcement plan for bulk writes.

✗ Fail

No way to enforce validation on migration writes, or throughput can't be scaled.

Reference: official docs

GATE 6

China / CDN delivery

45 min

Going in: API CDN cached is unlimited; backend is a single EU region (Belgium); no contractual region pinning.

Setup

A published document via the API CDN; BMW's Akamai in front.

Show us — live steps

Publish → measure propagation via the Live Content API / CDN.
Ask for the mainland-China delivery story given the single-EU-region backend.
Show cache invalidation for BMW's Akamai and the GROQ-webhook model.

Expected evidence to capture

A propagation number + a China plan + the invalidation mechanism.

✓ Pass

Concrete propagation + a credible China plan + reliable invalidation.

✗ Fail

China unaddressed and region pinning unavailable.

Reference: official docs

GATE 7

Exit & reversibility

45 min

Going in: Best content export of the three; revision history is NOT exported (point-in-time only).

Setup

A dataset with drafts, assets and revision history.

Show us — live steps

Run dataset export → confirm all non-deleted docs incl. drafts + assets are in the tarball.
Confirm revision history is NOT exported (point-in-time snapshot) and there's no field/user export beyond documents.
Note Portable Text is an open spec → lowest content lock-in.

Expected evidence to capture

An export tarball + explicit note on history/users.

✓ Pass

Complete content + asset export; history-continuity plan acknowledged.

✗ Fail

History/audit continuity has no answer for a regulated client.

Reference: official docs

GATE 8

Contractual signability

60 min

Going in: Sanity's gate is procurement, not engineering — press hard for written assurances.

Setup

Commercial / legal stakeholders in the room.

Show us — live steps

Get the API-enforced publish gate confirmed in writing (custom roles + content resources), and confirm Studio readOnly is NOT the security boundary.
Get a contractual SLA percentage, an ISO 27001 / TISAX roadmap, and EU region pinning for content AND assets.
Confirm the Enterprise attribute-path cap at 30 locales and the Content Releases model (Enterprise-only, no approval gates, 1,000-doc cap).

Expected evidence to capture

Written answers for the contract/RFP — the SLA number especially.

✓ Pass

A contractual SLA, a compliance roadmap with dates, and region pinning committed.

✗ Fail

'Most customers are fine' with no SLA number and no ISO/TISAX date.

Reference: official docs

Evidence checklist & contractual follow-ups

Capture during the day

Screen recording of every gate demo (GATE 1–4 especially).
Raw API responses: the GATE 2 Management-API publish attempt; GATE 5 429 / Retry-After traces.
CDA/GROQ payloads for GATE 1 (before and after the HQ update).
Written commercial answers for GATE 8 (SLA, residency, TISAX/ISO, uplifts, roadmap).
Open-risk register: each failed/partial gate → owner + follow-up deadline.

Contractual / commercial follow-ups (Sanity)

API-enforced publish gate confirmed in writing; Studio readOnly is not the security boundary.
A contractual SLA percentage (none is published today).
ISO 27001 / TISAX roadmap with dates; EU region pinning for content AND assets.
Enterprise attribute-path cap sized for 30 locales; Content Releases model + caps.
Agent Actions GA timeline + AI credit metering at BMW volumes.

Post-workshop scorecard

Fill this in before leaving the room, while the demos are fresh. Same template across all three vendors, so the three days are directly comparable. Circle one verdict per gate; a FAIL on GATE 1 or GATE 2 is decisive, not advisory.

Gate	Verdict	Evidence captured (link / file)	Owner & follow-up date
GATE 1Field-level HQ inheritance	PASSPARTIALFAIL
GATE 2API-enforced approval	PASSPARTIALFAIL
GATE 3Editor-grade visual preview	PASSPARTIALFAIL
GATE 4DAM / AEM Assets coexistence	PASSPARTIALFAIL
GATE 5Migration & cutover	PASSPARTIALFAIL
GATE 6China / CDN delivery	PASSPARTIALFAIL
GATE 7Exit & reversibility	PASSPARTIALFAIL
GATE 8Contractual signability	PASSPARTIALFAIL

DECISION RULE

Scores on the dossier are directional; the workshop is where the decision is actually made. GATE 1 (field-level inheritance after partial override) and GATE 2 (API-enforced approval) are pass/fail thresholds — a vendor that fails either is not a Phase-1 platform regardless of its weighted total. GATES 3–8 inform the contract and the build estimate.