Draft-only keys: publishing resource group (no publish/schedule into platforms)

Hi team,

The new "Restrict access" resource groups are great, but i like to be able to have an api key which is only allowd to edit and post new Drafts

Right now the posts resource bundles two very different powers: writing drafts and making content go live. I'd like a key that can create and edit drafts but gets a 403 on every state transition out of draft: publishNow: true, scheduledFor, queuedFromProfile, and isDraft: false on PUT. GET stays as scoped.

Why this matters for me: I run an agency platform on the multi-tenant setup from your guide (one profile per client). My clients want me to prepare content — they don't want my keys to be able to post as them. Today any key that can write drafts can also publish, so a leaked or buggy automation key can post straight to a client's Instagram. It also blocks a trust model some clients ask for: they own the Zernio account, hand the agency a draft-only key, review drafts, and press publish themselves. With this split that setup becomes structurally safe — same spirit as "restricted keys can't mint keys or invite teammates."

Either shape works:

• Solution 1: a toggle inside the publishing group ("can publish"), so drafts and transitions are separate resource groups

• Solution 2: split the permission group “Publishing

  Create, schedule and manage posts, media, queue and publishing logs.” into => “Draft” and “Publish”

• Solution 3: or a disabledResourceGroups value like "publishing.transitions" for programmatic provisioning

• Solution 4: Currently we have api key permission type “Read&Write”, and “Read” => add a third group “Draft”

Ideally webhooks behave like the messages split: a draft-only key's subscriptions still get post.published/post.failed for visibility, since reading status isn't the dangerous part.