Setting capabilities in the matrix

Every tick in the matrix is a capability of WordPress. Setting goes through WP_Role::add_cap() and remove_cap(), so straight into wp_user_roles. What stands here applies at once and everywhere — including to code that knows nothing about this plugin: every plugin that asks current_user_can() gets the same answer.

Change a role’s capabilities

1. In the left sidebar under “Roles & capabilities” choose the item “Capability matrix”.
2. Pick the role at the top. The ticks below belong to exactly that role.
3. Set and remove the ticks. Capabilities from plugins and themes stand in a group of their own, “From plugins and themes”.
4. Save with the button at the end — before that nothing is written.

“Sensitive” means: opens more than the name says

Some capabilities are marked as sensitive. edit_plugins, edit_themes and edit_files, for instance, are access to the server, not to the editorial desk: whoever holds them can write code into the site through the file editor. Kakapo Security can take those very capabilities away on purpose; here you see which role holds them at all.

Separating custom post types

Out of the box, custom post types share their capabilities with posts. Whoever may edit “Events” inevitably may edit posts as well. Under “Post types” this can be separated: the type gets capabilities of its own, and the matrix then shows them in a group of their own, “Custom post types”.

Why this has to happen early

WordPress fixes a post type’s capability mapping when it is registered. Setting it later would be too late, which is why the switch hangs on the filter register_post_type_args.

register_post_type_args