Core Principle (firm)

Upload ≠ Publish ≠ Delete

Those must be separate privileges, even if handled by the same humans at times.

---

Recommended Vimeo Role Model (Standard Plan)

1. Account Roles We Should Use

Vimeo roles (simplified):

• Owner → full control

• Admin → almost full control

• Contributor / Uploader → upload + edit own videos only

• Viewer → view/comment only

Our setup:

Role	Account	Purpose
Owner	Your personal account	Final authority
Contributor	vu@ministrycentral-europe.org	Upload only
Viewer / Contributor	content@ministrycentral-europe.org	Review & comments
Admin		Publish & organize

---

Folder-Based Risk Containment 

Folder Structure

Intake_review/
  └── incoming/
  └── MS001/
production/
  └── MS001/

Folder Permissions

Set permissions per folder, not globally.

/Intake_review/incoming

• mce-intake

  • ✅ Upload

  • ✅ Edit own videos (title, description)

  • ❌ Publish

  • ❌ Delete others’ videos

• Admin / Owner

  • Full access

/production/*

• mce-intake

  • ❌ No access

• Admin / Owner

  • Full access

This way:

• uploads cannot “leak” into production

• accidental publication is impossible

• deletions are contained

---

Video Privacy Defaults 

For incoming uploads, set default privacy to:

• Private or Unlisted

• ❌ Never “Public” by default

This ensures:

• nothing is indexable

• nothing is viewable without intent

You can enforce this in Account → Videos → Defaults.

---

Naming Conventions = Soft Control

Require a strict filename pattern at upload:

MS001.2_Q1_TeachingGoal_[InstructorInitials]_v1.mp4

Why this matters:

• discourages sloppy uploads

• prevents overwriting

• allows rollback without guessing

This is low-tech but very effective risk mitigation.

---

Disable What You Don’t Need

For the upload account (mce-intake):

• ❌ Disable:

  • analytics access

  • integrations

  • team management

• ✅ Allow:

  • upload

  • basic metadata editing

This reduces accidental clicks into dangerous areas.

---

Avoid These Common Traps

🚫 Do not:

• Share your owner/admin login

• Let instructors upload into production folders

• Rely on “review links” as a submission mechanism

• Use the WordPress server as a video staging area

Each of those increases risk without adding value.

---

Optional Extra Safeguard 

Add a human checkpoint:

“No video moves to production without:

• Coordinator review
• Naming + description verified
• Captions confirmed or scheduled”

Even if informal at first, this creates a culture of care.

---

Bottom Line

Your safest configuration is:

• 1 owner

• 1 shared upload account

• folder-level containment

• private-by-default uploads

• clear naming rules

This gives us enterprise-grade discipline on a Standard plan.