Capabilities

Overview

Manage capability grants and denials for an access level. Select the subject with AAM::api()->capabilities($access_level, $settings). Omit $access_level to use the current user or visitor.

PHP class: AAM_Framework_Service_Capabilities.

Method reference

Method	Purpose
`get_list()`	List explicitly configured entries.
`list()`	Alias of `get_list()`.
`add($capability, $is_granted = true, $ignore_format = false)`	Add a capability.
`remove($capability)`	Remove a capability.
`deny($capability, $ignore_format = false)`	Store a deny rule.
`allow($capability, $ignore_format = false)`	Store an allow rule.
`replace($old_slug, $new_slug, $ignore_format = false)`	Replace a capability or hook value.
`exists($capability)`	Check for an explicit capability.
`is_allowed($capability)`	Check the effective allow decision.
`is_denied($capability)`	Check the effective deny decision.

Return values vary by method. Rule updates usually return bool; reads can return a value, null, or an array. Errors follow the service’s error_handling setting and may produce WP_Error.

Accepted identifiers

Pass a WordPress capability slug string such as 'edit_posts' or 'manage_options'. replace() takes the old and new slugs. The $ignore_format flag on some methods controls AAM’s slug formatting; it does not change the input into a role or user identifier.

Example

$caps = AAM::api()->capabilities('role:editor');
$caps->deny('delete_others_posts');
$denied = $caps->is_denied('delete_others_posts');

This sets delete_others_posts to denied for the Editor role. $denied checks that role’s capability state after the change.

Developer notes

caps() is an alias for capabilities().
Check the difference between a missing capability and an explicit deny before changing role behavior.
The selected access level determines whose rules are stored or evaluated. See Access levels.

Behavior and parameters

add(), remove(), allow(), deny(), and replace() update native WordPress capability state for a role or user. deny() sets the flag to false; remove() removes the capability entry. exists() checks whether the capability is known to the service; is_allowed() and is_denied() resolve the decision.
A capability name such as edit_posts must be valid. Work against a specific role or user when changing grants; a visitor has no native WordPress capabilities.
caps() is the gateway alias for capabilities(). Read this service’s return values before using a capability decision as a security gate in custom code.