Can a dataset contain both public and private documents with different access?

Yes, absolutely! You can create a single dataset that contains both public and private documents, and control access so that clients only see public data while CMS users can access everything. This is done through custom roles and content resources with GROQ filters, not by creating separate datasets.

Here's how this works:

Using Custom Roles with Content Resources

Custom roles let you define granular permissions using GROQ filters to control which documents different users or API tokens can access. You can create a "content resource" that filters documents based on any field - like a isPublic or visibility field.

For example, you could:

1. Add a field to your documents (like isPublic: boolean)
2. Create a custom role for your public-facing client that only grants read access to documents where isPublic == true
3. Give your CMS users (editors/admins) roles that can access all documents

This approach using content resources with GROQ filters is much more flexible than separate datasets because you can filter on any document attribute - publication status, team assignment, locale, workflow state, or custom business rules.

Important Considerations

Dataset Privacy: When using custom roles to restrict content visibility, you should set your dataset to private. Public datasets allow all documents to be readable by anyone regardless of authentication, which would bypass your role-based restrictions.

API Tokens: You can apply custom roles to API tokens, which is perfect for controlling what your client-side application can access. Create a token with a role that only grants read access to your "public" content resource.

Availability: Custom roles are an Enterprise plan feature, so you'll need that plan level to implement this approach.

Alternative: Separate Datasets

If custom roles aren't available on your plan, you could create separate datasets (one public, one private), but this creates operational overhead - you'd need to manage content across multiple datasets and potentially duplicate shared content.

The single-dataset approach with custom roles is the recommended solution for most use cases involving mixed public/private content visibility.