Roles
How a role decides what someone can open and do, and how to build one.
Every user has one role, and the role decides which screens they see and what they can do on them. Roles are managed under Admin → Roles.
How a role is built
A role has two kinds of permission:
- Screens. Allowing a screen opens it, together with everything that screen needs to read. Someone who can open Posts can read post types, terms and media inside the editor without being given those screens of their own.
- Actions. Creating, editing, publishing and deleting are separate permissions, listed under the screen they belong to.
Each permission has three positions: Allow, off, or Deny. Deny blocks it even when a wider grant would allow it. Grant full access at the top allows everything.
Limiting a permission to some content
Some permissions can be limited, under Limit to specific content:
- to some post types, for example only news and articles,
- to some social channels, for sharing,
- to only their own posts or media, for editing, publishing and deleting.
With no limit, the permission applies to all content.
A limit on one permission does not bind a role that is also allowed the same thing through another screen without a limit. The role editor tells you when that is the case.
Checking a role before saving
Check access shows exactly what the role, as you have it on screen, would be able to do. Use it before saving a change.
When changes take effect
Someone already signed in gets a changed role within about ten minutes, without signing out.
Deleting a role
A role that someone still holds cannot be deleted. Move those users to another role first.