# Permissions

> The nine permissions of a connection, the presets, and which tools need which permission.

Every connection has permissions. Read & diagnostics is always on; add only what the app needs for the job. You choose them when you create the connection (or when you allow an app that signs in), and you can change them later in **PowerWP AI › Connections**.

## The permissions

| Permission | What it allows |
|---|---|
| **Read & diagnostics** | Site and server info, logs, health checks, files (secrets redacted), SELECT queries, content, options and WooCommerce data. Always granted. |
| **Content & store data** | Create, edit and delete posts, pages, products, orders, terms and media, WordPress REST writes and Elementor's page abilities. |
| **Settings & maintenance** | Change options, flush caches, manage cron, maintenance mode, debug mode, WooCommerce tools and other WordPress abilities that make changes. |
| **Files** | Write, edit, move, delete, upload and extract files. This allows code changes, so treat it like developer access. |
| **Database writes** | Run write SQL (with automatic row and table snapshots), search and replace, and database clean-ups. |
| **Plugins & themes** | Install, activate, deactivate, update and delete plugins and themes. |
| **Users** | Create, edit and delete users and change roles. |
| **Backups & restore** | Create and download full backups and restore them. |
| **Secrets** | Reveal secrets (wp-config credentials, API keys, password hashes) and edit wp-config.php and .htaccess. |

## Presets

Presets are ready-made sets of permissions. Pick one, then add or remove single permissions if you need to.

| Preset | For | Permissions |
|---|---|---|
| **Read-only diagnostics** | Investigate problems without changing anything. | Read & diagnostics |
| **Content manager** | Edit content and store data. | Read & diagnostics, Content & store data |
| **Developer** | Content, settings, files, database, plugins and backups, without secrets or user accounts. | Read & diagnostics, Content & store data, Settings & maintenance, Files, Database writes, Plugins & themes, Backups & restore |
| **Full access** | Everything, including secrets and user accounts. | Read & diagnostics, Content & store data, Settings & maintenance, Files, Database writes, Plugins & themes, Users, Backups & restore, Secrets |

> [!IMPORTANT] On the Free plan every connection can only read: new connections get Read-only diagnostics, and AI apps are told the site is on the Free plan.

## When a permission is missing

If your app tries something its connection may not do, PowerWP AI refuses the call and names the permission it needs (`required_scope`). Nothing is changed. Add the permission to the connection, or ask the app to do the job another way.

## Tools by permission

### Read & diagnostics

`abilities_list`, `ability_run`, `change_details`, `changes_list`, `changes_rollback`, `checkpoint_create`, `content_get`, `content_query`, `elementor_outline`, `terms_query`, `db_describe`, `db_query`, `db_tables`, `audit_log`, `cron_events`, `error_log_read`, `hooks_inspect`, `integrity_check`, `rescue_mode`, `security_scan`, `plugins_list`, `themes_list`, `updates_check`, `fs_find`, `fs_list`, `fs_read`, `fs_search`, `fs_stat`, `fs_transfer_link`, `memory_list`, `recipe_get`, `recipes_list`, `rest_request`, `rest_routes`, `maintenance_mode`, `option_get`, `http_request`, `page_check`, `server_info`, `site_health`, `site_overview`, `users_list`, `wc_order_inspect`, `wc_overview`, `wc_product_inspect`, `wc_scheduled_actions`, `wc_status`, `wc_tools`

### Content & store data

`content_create`, `content_delete`, `content_update`, `elementor_edit`, `media_import`, `term_manage`, `memory_save`, `recipe_save`

### Settings & maintenance

`cron_manage`, `debug_mode`, `cache_flush`, `option_delete`, `option_update`, `wc_scheduled_action_manage`

### Files

`archive_create`, `archive_extract`, `fs_copy`, `fs_delete`, `fs_edit`, `fs_mkdir`, `fs_move`, `fs_write`

### Database writes

`db_cleanup`, `db_execute`, `db_search_replace`

### Plugins & themes

`plugin_manage`, `theme_manage`

### Users

`user_manage`

### Backups & restore

`backup_confirm_downloaded`, `backup_create`, `backup_delete`, `backup_download_links`, `backups_list`, `job_cancel`, `job_status`, `restore_prepare`, `restore_start`

### Secrets

Source: https://powerwp.ai/docs/reference/permissions/