The safest agent is not the least capable one. It is the agent whose authority matches the task, whose actions are attributed to a person, and whose exceptions are visible to an administrator.
Start with jobs, not endpoints
A marketing assistant thinks in products, campaigns, and media—not REST routes. Permission labels should follow that mental model: view products, edit descriptions, upload media, publish changes.
Behind each label, the system can map a precise set of WordPress capabilities and WooCommerce operations. The interface stays understandable without weakening enforcement.
Permissions should describe work in plain language, not force a store manager to understand API internals.
Use a deny-by-default baseline
New staff should inherit no write access until an administrator assigns a role or selects specific tools. This makes onboarding deliberate and prevents a broad template from quietly expanding over time.
- Viewer: reports, products, inventory, and orders—read only.
- Operator: routine catalog and order updates with logged writes.
- Manager: staff, permissions, integrations, and approval rules.
- Owner: billing, credentials, data export, and destructive actions.
Keep exceptions short-lived
Sometimes a staff member needs temporary access to import stock or resolve an order issue. Time-boxed elevation is safer than permanently upgrading a role and relying on someone to remember later.
The permission ledger should show who granted the exception, its expiry, and every operation performed while it was active.