Capabilities & Role Access Management

Orbit modifies the capability sets for non-administrator management roles (editor and WooCommerce shop_manager) so client teams can manage site content, users, and forms effectively without granting full site administrator privileges.

Editor & Shop Manager Site Editor Access

By default, WordPress requires the edit_theme_options capability to access the Block Site Editor, navigation menus, and theme options.

Orbit grants edit_theme_options to editor and shop_manager roles by default, allowing content managers to edit block templates and navigation menus.

// Disable Site Editor access for Editors and Shop Managers
add_filter( 'orbit_enable_editor_caps_access', '__return_false' );

User Management Access

Orbit allows Editors and Shop Managers to manage users without giving them destructive deletion privileges:

• Granted Capabilities: list_users, create_users, edit_users
• Removed Capability: delete_users (always removed for Editors and Shop Managers)

// Revoke User Management access from Editors and Shop Managers
add_filter( 'orbit_enable_user_caps_access', '__return_false' );

Deletion Safeguard

Even when user creation and editing access is enabled, Orbit explicitly removes delete_users from editor and shop_manager roles. User deletions must be performed by a full site Administrator.

Gravity Forms Access Control

Orbit grants comprehensive Gravity Forms editing and entry management capabilities to Editors and Shop Managers:

• gravityforms_create_form
• gravityforms_edit_forms
• gravityforms_view_entries
• gravityforms_edit_entries
• gravityforms_export_entries
• gravityforms_view_entry_notes
• gravityforms_edit_entry_notes
• gravityforms_view_settings
• gravityforms_edit_settings

// Disable Gravity Forms management access for Editors and Shop Managers
add_filter( 'orbit_enable_gravity_forms_access', '__return_false' );

Privacy Settings Access

By default, WordPress requires manage_options (Administrator level) to access Privacy Policy settings (/wp-admin/options-privacy.php).

Orbit overrides the manage_privacy_options meta capability mapping, allowing Editors and Shop Managers to set and update the site Privacy Policy page.

// Disable Privacy Page access for Editors and Shop Managers
add_filter( 'orbit_enable_privacy_page_access', '__return_false' );

Capability Summary Reference Table

Feature Area	Affected Roles	Granted Capabilities	Filter Hook to Disable	Default
Site Editor	editor, shop_manager	edit_theme_options	orbit_enable_editor_caps_access	true (Granted)
User Management	editor, shop_manager	list_users, create_users, edit_users (Removes delete_users)	orbit_enable_user_caps_access	true (Granted)
Gravity Forms	editor, shop_manager	Form creation, entry viewing/editing/exporting	orbit_enable_gravity_forms_access	true (Granted)
Privacy Page	editor, shop_manager	manage_privacy_options	orbit_enable_privacy_page_access	true (Granted)