WordPress Ability Authorization (Two-Tier)

When to use

• Adding or reviewing permission_callback on wp_register_ability / register_rest_route.
• Auditing abilities for IDOR (missing per-object authorization).
• Centralizing an ability→capability map, or fixing an inconsistent auth error contract.
• Hardening abilities that may run with no current user (MCP/agent/background contexts).

The model

Tier 1 — coarse capability gate (permission_callback). Runs before execution, when the object id is not yet known. Check only general capabilities, classified by the privilege class the ability needs, not the object it touches: