The AI Abilities panel is the control board for everything an agent can do on your site. Every typed tool — reading posts, writing content, managing a plugin — is an ability, and this panel is where you turn them on, turn them off, and decide which agents may use them. Getting comfortable here is the difference between an agent that does exactly what you intend and one that has more reach than you realized.
In the AI Abilities panel you enable or disable each ability, see its type (read, write, destructive), and gate the powerful ones. Enable only what your workflow needs, keep destructive abilities off until required, and let token scopes do the per-agent control.
Open the Abilities panel
Go to NIBWP › AI Abilities. You will see the full catalogue — the 30+ built-in abilities plus any contributed by active plugin integrations — each with a name, a type, and a toggle. The panel is your master switchboard; token scopes then control which agent can reach which enabled ability.
Read the types
Every ability is one of three types, shown by a colored chip. The type tells you the blast radius:
| Type | Meaning | Examples |
|---|---|---|
| read | Fetches data, never changes it | search posts, list users, get a record |
| write | Creates or updates content | create post, update fields, upload media |
| destructive | Removes or overwrites data | delete file, execute PHP |
execute-php and delete-file are what make NIBWP capable of anything — and what you should enable deliberately, on staging first. Leave them off for everyday content work.Step 1 — Enable only what you need
A new agent does not need every ability. Start narrow: for a content workflow, enable the post, media and field abilities and leave the rest off. You can always enable more later. A smaller surface is a safer surface.
Step 2 — Understand the two layers of control
There are two gates between an agent and an action, and they work together:
- The panel toggle — is this ability enabled on the site at all? Off here means no agent can use it, ever.
- The token scope — of the enabled abilities, which can this agent’s token reach? A read token cannot call a write ability even if it is enabled.
Think of it as a site-wide master switch (the panel) plus a per-agent key (the token scope). Both must allow an action for it to happen.
Step 3 — Test what an agent can see
After enabling abilities, ask a connected agent what it can do. It will list the abilities its token can reach — a quick way to confirm the panel and the token agree:
You: What abilities do you have access to?\nlisting tools available to this token...\nread: wp-search, wp-list-posts, wp-get-post - write: wp-create-post,\nwp-update-post, acf-manage-fields
Best practices
- Enable per workflow — turn on the abilities a job needs, not the whole catalogue.
- Destructive off by default — enable
execute-phpand file tools only when a task truly requires them, on staging first. - Let scopes do per-agent control — the panel decides what the site allows; tokens decide what each agent reaches.
- Review after changes — when you enable something powerful, check the audit log after the first run.