Find the Abilities registered on your site
The Explorer is where a permission decision should start, because it is the only place the evidence behind a classification is visible.
- Abilities & permissions
- 4 min read
Browsing
Abilities are grouped by provider, which is how most operators actually work: decide what WooCommerce may be asked to do, then what core may be asked to do. Search and filters cover action, risk, category, exposure, and source.
A useful first pass on a new site: filter to delete and to critical, and look at what exists. Those are the entries you will care about later, so it is worth knowing they are there before an agent asks for one.
The detail view
Each Ability’s detail page shows:
- Input and output schemas.
- Native permission status — whether the connection user could perform it at all.
- Classification evidence: why it was judged the action, risk, and reversibility it was.
- Per-agent access, so you can see who already has it.
- Local invocation summaries — whether it has actually been used here.
When new Abilities appear
Activating a plugin that registers Abilities does not silently expand what your agents can do. New entries appear as blocked and stay that way until someone grants them.
Not because anything is now permitted, but because the registry is the map of what could be asked for. It is a cheap habit and it prevents surprises during an incident.
An empty registry
A fresh install before any plugin registers an Ability has nothing to govern. That is reported as such rather than as a failure. It becomes a problem only if you expected a specific provider to have registered something and it has not.
Abilities & permissions
Keep the boundary while you fix the problem.
A good fix restores intended behaviour without creating a second path around WordPress or the governed request lifecycle.