By default every WordPress administrator can read every conversation. If that is more access than you want to hand out, Sohay ships five capabilities you can grant individually.
The five
| Capability | What it unlocks |
|---|---|
sohaychat_manage |
AI Settings — provider, API keys, model. Implies all four below. |
sohaychat_view_conversations |
Dashboard and Conversations, read-only |
sohaychat_reply_conversations |
Reply, assign, pin, close. Implies view. |
sohaychat_manage_kb |
KB Settings and the sync routes |
sohaychat_view_logs |
Diagnostics, read-only |
Two implications are built in: sohaychat_manage grants the other four, and
sohaychat_reply_conversations grants sohaychat_view_conversations — you
cannot reply to something you cannot see.
WordPress’s own manage_options grants all five, so administrators keep
working with nothing to migrate.
The one to be careful with
sohaychat_manage is the keys-to-the-account capability. It covers API key
entry and model selection, which means it covers your provider bill.
Most people who need to answer chats do not need it.
Three arrangements that work
A support agent — grant sohaychat_reply_conversations. They can read and
answer chats, assign, pin and close, and take over a handoff. They cannot
reach your keys, change the model, or alter the Knowledge Base.
A knowledge-base editor — grant sohaychat_manage_kb, plus the usual
WordPress ability to edit posts. They can write articles and run syncs, and
they never see a customer conversation.
Whoever keeps the site running — grant sohaychat_view_logs. They can
read Diagnostics when something breaks without holding anything else. Clearing
the log buffer deliberately requires the higher sohaychat_manage, so
somebody with read access cannot erase the evidence.
The visibility scope
A non-administrator holding only sohaychat_view_conversations sees
conversations assigned to them or unassigned — not the whole inbox.
That is a real privacy control, not a UI convenience, and it is worth knowing when you plan how you assign. Somebody who should see everything needs an administrator account or the scope adjusted in code.
Granting them
Use whichever role editor your site already runs — Members, User Role Editor, or WP-CLI:
wp cap add editor sohaychat_reply_conversations
One thing to check afterwards
The implies-chain runs dynamically, so current_user_can( 'sohaychat_view_logs' )
returns true for an administrator even though the capability is not stored on
the role. Listing a role’s capabilities will not show them.
That matters in one direction: if you remove manage_options from a custom
role, the dynamic grants for that role disappear with it. Grant the Sohay
capabilities explicitly on any role you have trimmed.
Where to go next
The Conversations inbox for what the view capabilities actually reach.
