What an Ability is, and what it is not

The definition

An Ability is a registered, named action a system can request — acme/update-post, core/get-site-info, and so on. Each one declares an input schema and an output schema. WordPress owns the registry; any plugin can add to it.

RuleFence discovers that registry and treats it as the complete vocabulary of what an agent may ask for. An action that is not a registered Ability is not something an agent can request through the governed path at all.

What it is not

• Not a permission. An Ability existing on your site says nothing about whether any agent may call it. Every one starts blocked.
• Not a capability. WordPress capabilities are the native authority layer underneath. An Ability request is still checked against them.
• Not a guarantee of scope. One Ability can affect one item or many; that is what the bulk classification is for.

Why this framing helps

The alternative question — “can this integration write to my database?” — has no useful answer. “May this agent call acme/update-post, and should that pause for review?” has an answer you can defend in a meeting.

Related guides

• AuthorityFind the Abilities registered on your site

  Use the Ability Explorer to browse by provider with filters for action, risk, category, exposure and source, and read the detail view before deciding anything.

• AuthorityRead an Ability’s risk classification

  Action, risk, reversibility, scope, bulk and exposure — what each means, and why an Ability that cannot be classified is treated as more dangerous.

• AuthorityGrant your first permission

  Pick one narrow, reversible, non-public Ability, set it to allow, run one real request, and read the decision it produced before granting anything else.