7. Security & Guardrails

Security is paramount in agentic systems. This section covers agent roles, guardrails, audit logging, and human-in-the-loop workflows.

7.1 Agent Roles & Capabilities

function wp_agent_register_capabilities() {
    
    // Site Agent Role - for autonomous backend tasks
    add_role('site_agent', 'Site AI Agent', [
        // Content capabilities
        'agent_read_content'     => true,
        'agent_create_drafts'    => true,
        'agent_modify_content'   => true,
        'agent_publish_content'  => false,  // Requires approval
        'agent_delete_content'   => false,  // Requires approval
        
        // Media capabilities  
        'agent_read_media'       => true,
        'agent_upload_media'     => true,
        'agent_modify_media'     => true,
        'agent_delete_media'     => false,
        
        // Site capabilities
        'agent_read_settings'    => true,
        'agent_modify_settings'  => false,
        'agent_install_plugins'  => false,
        'agent_execute_code'     => false,
    ]);
    
    // Frontend Agent Role - for user-facing interactions
    add_role('frontend_agent', 'Frontend AI Agent', [
        'agent_read_content'     => true,
        'agent_search_content'   => true,
        'agent_personalize'      => true,
        'agent_translate'        => true,
        'agent_assist_forms'     => true,
        'agent_read_user_data'   => false,  // Only with consent
    ]);
}

7.2 Guardrails Configuration

// In wp-config.php or via admin settings
define('WP_AGENT_MODE', 'supervised'); // 'autonomous' | 'supervised' | 'disabled'

define('WP_AGENT_APPROVAL_REQUIRED', [
    'publish_post'      => true,
    'delete_post'       => true,
    'send_email'        => true,
    'create_user'       => true,
    'install_plugin'    => true,
    'update_core'       => true,
    'process_refund'    => true,
]);

define('WP_AGENT_RATE_LIMITS', [
    'api_calls_per_minute'   => 60,
    'drafts_per_hour'        => 50,
    'media_uploads_per_hour' => 100,
]);

define('WP_AGENT_COST_LIMITS', [
    'daily_api_budget'    => 10.00,  // USD
    'per_request_max'     => 0.50,
    'alert_threshold'     => 0.80,   // Alert at 80%
]);

7.3 Comprehensive Audit Trail

class WP_Agent_Audit_Log {
    
    public function log( array $entry ): int {
        return wp_insert_post([
            'post_type'   => 'agent_audit_log',
            'post_status' => 'publish',
            'meta_input'  => [
                '_agent_id'        => $entry['agent_id'],
                '_action'          => $entry['action'],
                '_target_type'     => $entry['target_type'],
                '_target_id'       => $entry['target_id'],
                '_changes'         => json_encode($entry['changes']),
                '_reasoning'       => $entry['reasoning'],
                '_tokens_used'     => $entry['tokens_used'],
                '_cost'            => $entry['cost'],
                '_rollback_data'   => json_encode($entry['rollback_data']),
            ]
        ]);
    }
    
    public function rollback( int $log_id ): WP_Agent_Result;
    public function get_agent_history( string $agent_id ): array;
    public function get_pending_approvals(): array;
}

7.4 Human-in-the-Loop Workflow

class WP_Agent_Approval_Queue {
    
    public function queue( string $action, array $params, string $agent_id ): int;
    public function approve( int $queue_id, int $user_id, string $notes = '' ): WP_Agent_Result;
    public function reject( int $queue_id, int $user_id, string $reason ): bool;
    public function get_pending_for_user( int $user_id ): array;
}

7.5 PII & Data Protection

// Automatic PII detection and handling
add_filter('wp_agent_before_process', function($data, $context) {
    $pii_handler = new WP_Agent_PII_Handler();
    
    return $pii_handler->process($data, [
        'mask_emails'       => true,
        'mask_phones'       => true,
        'mask_addresses'    => true,
        'mask_credit_cards' => true,
        'allowed_fields'    => ['display_name', 'public_email'],
    ]);
}, 10, 2);

Related Articles

• Settings
• Audit Log
• Frontend Chat Security
• Security and Privacy