Capabilities and roles

The Aimogen Pro capability model, which roles get access, how the capability is granted and removed, and how to restrict access properly.

The capability#

Aimogen Pro uses a single custom capability: access_aiomatic_menu.

It gates every plugin admin screen, and is used as the capability mapping for all seventeen plugin post types — edit_posts, edit_others_posts, delete_posts, publish_posts, read_private_posts and delete_post all map to it.

How it is granted#

On plugins_loaded, and only in the admin, the plugin reconciles the capability against a list:

1. The list always contains administrator.
2. Any roles configured in Additional Roles (System & Logs › AI Usage Limits) are added.
3. Every role not in that list has the capability removed if it has it.
4. Every role in the list has it added if it lacks it.

That reconciliation runs on every admin request, which has an important consequence.

What the capability allows#

A user with access_aiomatic_menu can:

• Open every Aimogen Pro admin screen not otherwise restricted
• Create and run rules and workflows, spending API budget
• Configure the chatbot
• Create and run AI Agents with any enabled tool
• Use the Playground, which is unrestricted API access

Screens with stricter checks#

Two places require more than the plugin capability:

The Snippets check is deliberate: snippets execute PHP.

Restricting access#

Three mechanisms, in increasing strength.

Workspace hides menus per user. Convenience only — it does not remove capabilities and does not stop direct URL access.

Menu restrictions are role-based rules stored in aiomatic_Menu_Rules and enforced server-side. Use these to keep a role out of specific screens.

Removing the capability is absolute: take the role out of Additional Roles and the reconciliation removes it.

Checking it in code#

if ( current_user_can( 'access_aiomatic_menu' ) ) {
    // The user can use Aimogen Pro.
}

if ( current_user_can( 'manage_options' ) ) {
    // Full administrative access.
}

If you build a front-end tool that calls the PHP API, add your own capability check. The API does not perform one — it assumes the caller has decided.

Front-end users#

Visitors and subscribers do not need access_aiomatic_menu to use front-end features. The chatbot, AI Forms and generator shortcodes work for anyone the settings permit.

Those are governed instead by:

• Usage limits, including guest credits
• The required_user_capability attribute on [aimogen_user_remote_chatbot]
• Login requirements on [aimogen_post_creator]
• The aiomatic_ai_allowed filter, for arbitrary logic

Multisite#

The capability is granted per site. A user needs it on each site where they should have access.

Licensing, by contrast, is network-wide. See Requirements.

A sensible model#

The Playground and Agents are the two screens most worth restricting: the first is unrestricted API spend, the second is unrestricted action.

Related#

• Menu restrictions
• Usage limits and credits
• Permissions and access control