Limit an AI agent to Editor, not Admin
An AI agent takes on whatever WordPress user connects it. Here is why Editor beats Administrator as that account, and how to scope the connection on purpose.
Read moreThe governed agent blog
Plain guides, governance notes, and honest use cases for running an AI agent against your own WordPress site.
List WooCommerce coupon discounts with AI
How to list, audit, and retire WooCommerce coupons with an AI agent: reads first, approval before any write, and every coupon write locked behind a second gate.
Read moreWordPress MCP Adapter vs a governed layer
The WordPress MCP Adapter is the official building block for AI agents. Agent Abilities for MCP adds a governed catalog, admin UI, and audit log on top of it.
Read moreA WordPress AI audit log you can trust
Three 1.6.2 fixes make the plugin's audit log worth trusting: it records the true cause of a block, covers every path that changes state, and stays readable.
Read moreGuard WooCommerce customer data from AI agents
Managing a store and editing a user are different powers. Here is why customer data belongs behind the capability that actually governs editing user accounts.
Read moreWe said the audit log stored nothing. That was not quite true.
In 1.6.2 we corrected a claim about the audit log. It keeps identifier-only values by design, never free-text content, and here is why that line matters.
Read moreWhat we fixed in the 1.6.2 hardening release
Version 1.6.2 corrects a claim about our own audit log, tightens who can edit customer data, and closes gaps in what the plugin records and sanitizes.
Read moreHigh-risk lock and read-only mode, explained
Two controls decide what an AI agent is even offered on your WordPress site, before any per-call permission check runs: the high-risk lock and read-only mode.
Read moreWhat we fixed in the 1.4.1 standards release
A user-reported OAuth bug and six related fixes bring error responses, discovery, and tool status codes in line with what MCP and OAuth clients expect.
Read more