Ability Gate

The problem

AI agents can now work on your site. Claude, Cursor and on-site AI features connect through an MCP plugin or an Application Password and call WordPress abilities: edit a post, change a price, update a setting. Most tools only ask the agent to be careful. That is a request, not a control, and an Application Password usually carries the whole role of the user who made it. A log tells you about the damage afterwards; it does not stop a bulk price change or put your data back.

How it works

Ability Gate sits on the server, in front of every ability call an agent makes, so the agent cannot skip the check or approve itself. For each call it:

• Identifies the agent. Each Application Password, AI-plugin agent user, MCP STDIO session and on-site AI Client caller becomes a named agent with its own mode, rules and limits.
• Scores the risk. Every ability gets a level from low to critical, based on its name, annotations and exposure.
• Decides. Low and medium risk calls run with a snapshot so they can be undone. High and critical calls wait for a person. Your rules and each agent’s mode can change that.
• Tells the agent what happened. A held call returns a clear message with a request id, never a fake success.

People logged in to wp-admin, cron jobs and your own code are not gated.

Approval and rollback

• Held calls appear under Agent Control > Approvals. Approving runs the action as the agent’s own user, and the agent collects the result once by repeating the call or asking the ability-gate/get-request ability.
• Preview changes runs a held action inside a database transaction, shows the row-by-row changes and rolls them back, with outgoing HTTP, email, cron and schema changes blocked.
• Every gated write is recorded at the database row level, including options, meta, users, terms and WooCommerce tables. Rollback first checks whether anyone changed those rows since, and shows you which ones before overwriting.

What rollback cannot do: effects outside the database, such as sent emails, calls to other services, uploaded files or plugin switches, are listed as not undone and need your confirmation. Writes that could not be recorded exactly mark the snapshot as partial.

Control without approval fatigue

Agent modes (paused, restricted, trusted), rules for an ability, namespace or category, one-hour grants and per-agent hourly limits let you hold only what matters and keep the rest cheap to undo.

A record you can show someone

Every agent call is logged with the agent, credential, risk and outcome. Secrets are redacted, each event is hash-chained to the one before it, and Verify integrity reports any edited or removed row. Export to CSV or NDJSON for any date range.

Requirements

WordPress 7.1 or newer and PHP 7.4 or newer. WooCommerce is optional. An AI provider in Settings > Connectors is needed only for AI token budgets. No telemetry; the only outbound connections are license and update checks.