AI Agent User Management
Per-agent identities. Scoped permissions. Approval checkpoints. Tamper-resistant audit.
Connect three AI agents to a WordPress site and they share one admin account by default. That's not how teams work — and it's not how AI agents should either. User Management gives each agent its own identity, its own permissions, and its own audit trail.
Agents need accounts. Not shared admin keys.
When you give an AI agent access to your WordPress site, the question of "who did that?" stops being theoretical. Without identity, every action looks like the human admin. Without permissions, every agent can do everything. Without audit, you can't tell what changed and why.
This module fixes that with the same primitives WordPress already uses for human users — identities, capabilities, and an audit trail — extended for the way AI agents actually work: many connections, scoped tools, approval gates on sensitive actions.
Six controls that turn agents into accountable users.
Per-agent identities
Every connected AI agent gets its own account. "Claude on my MacBook" and "ChatGPT on the team Slack" are separate identities with separate permissions.
Granular permission scopes
Allow drafts but require human approval to publish. Allow product description edits but block price changes. Scoped down to the WP capability level.
Approval checkpoints
Mark sensitive actions as requiring approval. The agent stages the change; you approve in the WP admin or in your inbox before it goes live.
Tamper-resistant audit log
Every action is logged with agent identity, timestamp, requested change, and approval status. Append-only — agents cannot delete or rewrite their own history.
Per-agent rate limits
Set how many calls per minute each agent can make. Stops a runaway loop in one agent from hammering your site or eating into another agent's budget.
One-click revoke
Disconnect any agent instantly. Their tokens are invalidated, in-flight requests are cancelled, and the audit trail records the revocation.
Built on WP capabilities you already know.
When an agent connects via OAuth, AI Connector creates a connection record. This module attaches an agent identity to that connection, with a capability set you control. Every action runs through the standard WordPress capability checks — same checks your existing themes and plugins use — plus an additional approval gate for anything you flag as sensitive.
The audit log writes to a dedicated database table that the agent's connection cannot modify, even with full admin scope. Export to CSV for compliance. Filter by agent, action type, or date range to investigate.
Stop sharing the admin account with your AI.
Install AI Connector free, then add User Management when you connect more than one agent.