AI Agent Workflows uses feature-level WordPress capabilities. You can grant access to workflow editing, run history, connections, webhooks, or settings separately. These capabilities are not per-workflow ownership rules: a user who can manage workflows is not automatically limited to workflows they created.
Plugin capabilities
dragaiw_manage_workflows— create, edit, activate, and manage workflows and access the Workflow Editor.dragaiw_manage_runs— access run history, run details, and run actions.dragaiw_manage_connections— manage saved connections.dragaiw_manage_webhooks— manage incoming webhook endpoints.dragaiw_manage_settings— change plugin settings, including retention and background execution.dragaiw_access— top-level menu visibility. The plugin grants this when a user has any one of its granular capabilities.
Screenshot to add: [Agent Workflows menu and feature-level submenus]
Assign only the access a user needs
- Review the tasks the user must perform before assigning capabilities.
- Use your WordPress role/capability management process to grant only the required
dragaiw_*capabilities to the intended role or user. - For example, a user who only needs to inspect run history should receive
dragaiw_manage_runs, not workflow, connection, webhook, and settings access by default. - Sign in with a test account or use an authorized test user to confirm the expected screen is available and unrelated screens are not.
Understand administrator access and menu behavior
On activation, the plugin grants its capabilities to the WordPress Administrator role. It also treats manage_options as a full-access fallback, so users with that capability receive all plugin capabilities even if the explicit dragaiw_* capabilities are not assigned. Do not grant manage_options to a restricted role if you intend to limit its plugin access.
The Agent Workflows top-level menu is visible to a user with any granular plugin capability. Individual submenu items use their own capability, so unauthorized submenu items are hidden. If the user has access only to Runs, the menu handler redirects from the default Workflows page to a menu-visible page the user can access.
REST API and workflow ownership
The plugin’s workflow, node-type, connection, provider, and test routes use permission callbacks that check the relevant capability. Connections can be listed by users with either workflow-management or connection-management access, and creating a connection from the builder is allowed to either of those groups. Run actions use the run-management capability.
The inspected implementation does not enforce per-workflow ownership or restrict a workflow manager to their own workflows. Treat dragaiw_manage_workflows as access to the workflow-management feature area. If your organization requires per-workflow separation, enforce that through an additional reviewed access-control layer rather than assuming the existing capability model provides it.