Skip to main content
Cookbook Security

Create a limited role for a client or contractor with AI

Give a contractor access to exactly the products, orders, or SEO fields they need, and nothing else.

Difficulty Intermediate
Time ~10 min
Tools run_wp_cli

Prerequisites

A connected site, the contractor account (email or username), and a clear list of what they should be allowed to change.

The prompt
I am giving [a contractor/client] access to my site and I only want them to be able to [what they should manage, for example edit products and orders, or edit SEO titles and meta descriptions]. Their account is [email or username].

Grant that account only the capabilities needed for that job, and nothing to do with plugins, themes, other users, or site settings. First, list every capability you plan to add so I can approve it. After I confirm, apply them, then show me the account's full capability list so I can verify it cannot reach anything sensitive. If I hire people for this same job often, also create a reusable role named "[role name]" with the same capabilities so I can assign it from the Users screen next time.

Already connected to WPVibe?

Skip the copy-paste. Just ask your AI for the “Create a limited role for a client or contractor with AI” recipe, or describe the task, and WPVibe runs these steps on your own site.

You hire someone to update your products or clean up your SEO, and the only account you know how to make is another administrator. Now a person you barely know can install plugins, remove users, and change the settings that keep the whole site running. Most owners hand over full admin anyway, because building a narrower set of permissions by hand means knowing dozens of WordPress capability names.

WPVibe grants an account exactly the capabilities the job needs and nothing else. Tell it the person should manage products and orders, or edit SEO titles, and it adds only those permissions, then shows you the account’s full capability list so you can confirm nothing about plugins, users, or settings slipped in. If you hire for the same job often, it can also save the permissions as a reusable role you assign from your Users screen.

Describe what the person should be able to touch in plain language and give WPVibe their username or email. Ask it to list the capabilities it plans to add before it applies them, and to show you the final capability list afterward so you can spot-check. When the engagement ends, one more ask strips those permissions back out.

Outcome

The contractor account can edit only the areas you named, with no access to plugins, users, or site settings.