Capability & permission checks (authorization)

When to use this skill

Use this skill wherever code does something not everyone should be able to do:

• Admin menu/submenu pages and settings screens.
• AJAX (wp_ajax_*) and REST permission_callbacks.
• admin-post.php handlers and action links (delete/approve/activate).
• Editing options, users, posts, taxonomies, files, or plugin state.
• Anything reading or writing another user's data.

Authorization answers "is this user allowed?" — distinct from the nonce, which answers "did this request come from us?" (see nonces-csrf-protection). Use both.

Core principles (and why they matter)