Identity
Choose an agent’s connection user
This is the single most consequential decision in the setup. Agent policy can only narrow what this user could already do — it can never widen it.
- Agents & identity
- 5 min read
The role you pick is the ceiling
Every governed request is checked against native WordPress authorization independently of any policy you configure. If the connection user cannot perform an action, no allow rule, approval, or plan will make it possible.
That cuts both ways, and the useful direction is this: a narrow connection user is a hard limit that survives a policy mistake. If you misconfigure the permission matrix on a Subscriber-backed agent, the worst case is still bounded by what a Subscriber can do.
Always create a dedicated user
- One user per agent. Sharing a user between two agents means either agent’s ceiling is the other’s ceiling too.
- Never your own account. An administrator’s ceiling is everything, and the activity would be attributed to a login you also use interactively.
- Never an existing staff account. Same reason, plus the person leaving the company should not break an integration.
Guided setup deliberately does not create an Application Password for the administrator running it. A dedicated user must be chosen explicitly.
Which role
Start from the smallest role that can do the job and move up only when a real request is refused for a reason you agree with.
| If the agent needs to… | Start with |
|---|---|
| Read site data only | Subscriber |
| Draft content it cannot publish | Contributor |
| Publish its own content | Author |
| Edit other people’s published content | Editor |
| Anything requiring Administrator | Stop and reconsider the design |
If you find yourself reaching for Administrator, the question to ask is whether the agent has been asked to do something outside its remit. See Check the WordPress authority ceiling.
Custom roles
A custom role with exactly the capabilities one agent needs is the most precise option, and it is worth the effort for a production agent that writes. Create it with whatever role editor you already use; RuleFence reads native capabilities and does not need to know how the role was made.
Agents & identity
Keep the boundary while you fix the problem.
A good fix restores intended behaviour without creating a second path around WordPress or the governed request lifecycle.