The question is not rhetorical. Count the people who can change your homepage right now, subtract the ones who should be able to, and you have measured your governance. The goal is not zero. The goal is a number somebody chose.
Ask this question in any web operations review and watch what happens. Nobody knows the answer. Then somebody checks, and the answer is worse than anyone guessed: current staff who never needed access, an agency from two engagements ago, a contractor whose last invoice cleared in a previous fiscal year.
SEEN IN THE FIELD [REPRESENTATIVE]: 11 ACCOUNTS WITH PUBLISH ACCESS / 4 BELONGING TO PEOPLE NO LONGER UNDER CONTRACT / 0 CHANGES LOGGED
The count is not the problem. The count is the symptom. The problem is that nobody chose the count, which means nobody owns it, which means the website your revenue depends on is governed by accumulation.
Web governance fails in two directions, and most companies pick one.
The first failure is the fortress. Every change ships through a developer ticket. The queue is real, the turnaround is days or weeks, and marketing learns to stop asking. The homepage becomes very safe and very stale, and the highest-value pages on the site go untouched for quarters at a time. The fortress does not prevent damage. It prevents maintenance, and search engines read unmaintained the same way buyers do.
The second failure is the commons. Everyone can edit, so nobody is responsible. Templates fork, off-brand pages multiply, and one afternoon a well-meaning edit takes the hero down in production because production is the only environment there is.
A publishing model is not a permissions setting. It is a decision about who owns the website when something goes wrong.
Good governance is unremarkable, which is why nobody writes it down. A short, named list of people with publish access, reviewed on a schedule. A staging environment, so change happens somewhere reversible. A rollback path that has actually been tested, not just assumed. A change log, so Tuesday's breakage takes five minutes to diagnose instead of a war room.
None of that requires an enterprise platform or a governance committee. It requires somebody deciding on purpose. The Tuesday question is how you find out whether anyone ever did.
Ask it this week. The answer is one query away, and it is the cheapest audit your website will ever get.
One email when something worth reading exists. No cadence, no drip, unsubscribe stays one click.