Access Levels

An access level answers whose rules? A resource identifier answers which post, URL, user, or other target? Choose the access level when you get a service; pass the target to a service method. The four levels are default, role, user, and visitor.

$role = AAM::api()->role('subscriber');
$role->posts()->deny(34, 'read');
// Equivalent: AAM::api()->posts('role:subscriber')->deny(34, 'read');

Both forms save the same post rule for Subscribers: the first starts from a role object, and the second passes the role string to the service.

Ways to select a level

Form	Example	Result
Omit the service argument	`AAM::api()->posts()`	Current user, or visitor for an anonymous request.
Pass a service string	`AAM::api()->posts('role:editor')`	Rules for that role.
Pass an access-level object	`AAM::api()->posts(AAM::api()->user(42))`	Rules for that user.
Start from an access-level object	`AAM::api()->role('editor')->posts()`	A posts service bound to that role.

The service argument accepts an AAM_Framework_AccessLevel_Interface object, not a raw WP_User, WP_Role, or post ID. Resolve a WordPress user first, then pass the access-level object:

$user = AAM::api()->user(new WP_User(42));
$posts = AAM::api()->posts($user);
$posts->deny(['slug' => 'annual-report', 'post_type' => 'page'], 'read');

Here $user is the subject; the array in deny() identifies the page. Calling posts(42) would put 42 in the access-level position and fail.

Supported service strings

String	Access level
`role:editor`	Existing WordPress role slug.
`user:42`	WordPress user ID.
`user:editor_name`	WordPress login.
`user:editor@example.com`	WordPress email address.
`visitor`, `guest`, `anonymous`	Visitor.
`default`, `all`, `anyone`, `everyone`	Default level.

The prefixes and aliases above are exact strings. A bare role slug such as editor, a bare user ID, and a WP_User object are not service access-level values. Unknown users or roles produce an error according to the service’s error_handling setting.

Gateway methods

Use AAM::api()->role('editor') for a role and AAM::api()->user(42), user('editor_name'), user('editor@example.com'), or user(new WP_User(42)) for a user. user() with no argument returns the current user or visitor; user(0) returns visitor. visitor(), guest(), and anonymous() are equivalent. default(), all(), any(), anyone(), and everyone() return the default level. The any() alias is a gateway method, not a service string.

Inheritance

Default
├── Role → User
└── Visitor

A user normally inherits from the primary WordPress role, then default. A visitor inherits from default. If a user has no valid role, default is the parent. When AAM multi-role support is enabled, the user’s additional roles become siblings of the primary role and their permissions are merged according to AAM’s merging preference. A directly configured rule can override an inherited one.

Common methods

Method	Purpose
`get_id()`	User ID or role slug; `null` for default and visitor.
`get_display_name()`	Human-readable name.
`get_parent()`	Parent access level or `null` for default.
`get_resource($type, $reload = null)`	Underlying resource object. Pass `true` to bypass its cached instance.
`get_preference($type, $reload = null)`	Underlying preference object.
`get_proxy_instance()`	Wrapped WordPress user or role for those levels.
`add_sibling($level)`, `has_siblings()`, `get_siblings()`	Manage or inspect same-level role inheritance.
`$level->posts()`, `$level->urls()`, etc.	Get a service already bound to this level.

Use service methods for normal application code. Lower-level resource and preference objects are intended for framework extensions.