Security model
Controls enforced where the content lives
OAuth, scopes, WordPress capabilities, risk tiers, approvals, version checks, audit events, and rollback records remain server-side controls.
01
Authentication
Remote clients use OAuth 2.1 with PKCE. Local profiles may use WordPress Application Passwords. Secrets are not written into generated client configuration.
02
Authorization
- Per-credential scopes limit the operation set.
- WordPress capabilities are checked again at execution.
- New dynamically registered remote clients default to a site:read ceiling.
03
Approval binding
Sensitive work pauses for an expiring approval bound to the exact change hash. Changing the plan invalidates the approval.
04
Failure behavior
Version drift, missing authority, incomplete approval, and partial rollback fail closed. A failed compensation is not reported as success.