# Skill: Users and Permissions

Skill ID: `users-permissions`

Rules
- Authorize by capability, not role slug.
- Check authorization before reading/mutating request payload.
- Protected REST routes require strict `permission_callback`.
- Never use `__return_true` for privileged REST routes.
- Admin-only actions require `manage_options`.
- Use least-privilege capabilities for non-admin actions.
- Require authenticated context for user-scoped resources.
- Never use `is_admin()` for security decisions.
- Use `is_user_logged_in()` checks for user-scoped data/actions.

Capability guidance
- `manage_options`: settings/global admin actions.
- `edit_posts` / resource capability: content-linked translation actions.
- `read`: low-risk authenticated operations.

Mistakes to avoid
| Mistake | Fix |
|---|---|
| Role-name checks (`administrator`, `editor`) | Use `current_user_can()` capability checks |
| Missing REST permission callback | Add strict `permission_callback` |
| Permission check after work starts | Check first, then process |
| No login check on user-scoped route | Enforce authenticated context |
| Hardcoded user IDs in auth logic | Resolve current user dynamically |