Title: RuleFence – AI Agent Control Author: RuleFence Published: September 21, 2026 Last modified: September 21, 2026 --- Search plugins ![](https://ps.w.org/rulefence/assets/banner-772x250.png?rev=3704831) ![](https://ps.w.org/rulefence/assets/icon-256x256.png?rev=3704831) # RuleFence – AI Agent Control By [RuleFence](https://profiles.wordpress.org/wpagentmanager/) [Download](https://downloads.wordpress.org/plugin/rulefence.1.0.0.zip) * [Details](https://wordpress.org/plugins/rulefence/#description) * [Reviews](https://wordpress.org/plugins/rulefence/#reviews) * [Installation](https://wordpress.org/plugins/rulefence/#installation) * [Development](https://wordpress.org/plugins/rulefence/#developers) [Support](https://wordpress.org/support/plugin/rulefence/) ## Description Give an AI agent a WordPress login and it can do anything that login can do. The role is the only limit, and roles come in whole jobs: a Shop Manager can refund an order as easily as fix a typo in a product description. RuleFence draws the line inside the job. Every agent gets its own identity and its own credential, so you can see which agent did something and not just which user. Every registered Ability gets a decision – allow it, hold it for a person, or refuse it outright – and a request that turns out riskier than the Ability looked can be escalated on the spot rather than waved through. One switch stops every agent on the site at once. All of it – the decisions, the requests, the refusals – lands in a signed record that cannot be edited afterwards, not even by this plugin. In practice that reads like: this agent may look up orders and add notes to them, must ask a person before it changes an order’s status, and may never delete a product. It connects to the clients people are actually using – Claude Desktop, Claude Code, Cursor, ChatGPT, anything else that speaks the Model Context Protocol, or plain REST. Setting up a connection ends with a configuration block you paste into the client, with the credential already in it. It governs the WordPress Abilities API, so it covers whatever your plugins register– core, WooCommerce, your own – rather than a fixed list. That also sets the scale: a site whose plugins register a lot of Abilities has a lot for this to govern, and a site with none has little. WordPress 7.1 itself registers three, all read-only. Abilities are what it governs, and that is worth being exact about. An agent’s credential is a WordPress user, so anything that user could already do through the ordinary REST API, it still can – the permission matrix is not in that path. What limits it there is the WordPress user you map the agent to, which is why this plugin asks for a least-privilege one, warns you when an agent is mapped to an administrator, and scores it in Readiness. WordPress capabilities are the ceiling; the matrix is how you carve out what an agent may do underneath it. #### The rule everything else follows An Ability nobody granted is refused. A new agent starts paused and is allowed nothing, and stays that way until you say otherwise, one Ability at a time. Nothing you install can widen that by accident, because nothing widens it except you. #### What it does * **Identity.** Each agent is a managed identity with its own credential, mapped to a least-privilege WordPress user. You can see which agent did what, not just which user. * **Permissions.** A matrix of every registered Ability against every agent: allow, require approval, or block. * **Approvals.** A risky request stops and waits for a person. The approval is bound to the exact input it was granted for, so it cannot be reused for a different request. * **Risk.** A contextual engine reads the request itself – how many records, how large a change, how sensitive – and can make a decision stricter than the matrix, never weaker. * **Previews.** See what a write would do before it happens. * **Activity and audit.** Every decision is recorded with its reason, allowed or blocked, in a hash-chained trail that can prove it has not been edited. * **Emergency controls.** Stop every agent on the site immediately, or drop everything to read-only, in one click. * **Readiness.** A scored check of what still weakens the site, with the evidence behind each score. * **Runtime verification.** The governance controls are re-tested on the installed site rather than assumed. #### Using it with Claude, ChatGPT, Cursor and other MCP clients RuleFence is not the MCP server and does not pretend to be one. WordPress 7.1 registers Abilities, the official MCP Adapter publishes them over the Model Context Protocol, and an MCP client – Claude Desktop, Claude Code, Cursor, ChatGPT, Windsurf, whatever you use – calls them. RuleFence is the layer that decides which of those calls are allowed, which wait for you, and which are refused, and records all of it. That means it governs whichever of those clients you connect, including more than one at a time, each with its own identity and its own credential that you can revoke on its own. Setting up a connection ends with the endpoint, a username, an Application Password and a configuration block you paste straight into the client. A site with no MCP Adapter is still covered: the same credential works against the REST endpoint. #### What this plugin is, and what a separate add-on adds Everything above is this plugin. There is no licence key, no edition, and nothing in it that a payment unlocks – what you install is what you get, working, for as many agents as you care to run. A separate paid add-on, RuleFence Pro, is available from [rulefence.com](https://rulefence.com/pro) and adds conditional policies and ready-made policy sets, a simulator that tries a draft policy against calls already recorded, a record of which rules actually fire, multi-step workflows with human checkpoints, undo and rollback, scheduling, email alerts and webhooks, approval routing, risk threshold and rate ceiling tuning, audit export, custom retention, saved activity views, reusable agent and permission profiles, and configuration transfer between sites. A further tier governs a multisite network: shared policies, one approval queue, a fleet inventory, and named site groups. It is a second plugin you install alongside this one; nothing about it is present here. That is worth being plain about, because the two arrangements look similar from outside and are not. This plugin does not ship the paid features in a disabled state. The screens have no buttons that exist to tell you what something would cost, and no control is switched off waiting for a key. What is never sold, in this plugin or that one: default-deny, human approvals, the signed audit chain, audit logging, secret redaction, emergency mode, WordPress capability checks, failing closed when audit integrity is unavailable, and session expiry. A security control that only works if you pay is not a security control. #### External services This plugin contacts nothing, ever. There is no analytics call, no version ping, no licence check and no webhook. Your agents, permissions, decisions and audit trail live in your own database and are never sent anywhere. The two features that could make an outbound request – webhook notifications, and validating a licence key – both belong to the paid add-on. Neither is here, so there is no code in this plugin that could make a request even if something asked it to. Agents reach your site from outside it, over the REST API, using an Application Password you issue and can revoke. That is inbound, and it is what the plugin exists to govern. ## Screenshots [⌊The dashboard: what needs a person, what each agent has been doing, and the one control that stops all of it.⌉⌊The dashboard: what needs a person, what each agent has been doing, and the one control that stops all of it.⌉[ The dashboard: what needs a person, what each agent has been doing, and the one control that stops all of it. [⌊Agents: every AI client as a named identity, with the state it is in and whether it holds a working credential.⌉⌊Agents: every AI client as a named identity, with the state it is in and whether it holds a working credential.⌉[ Agents: every AI client as a named identity, with the state it is in and whether it holds a working credential. [⌊Connections: the Application Passwords that identify agents, each mapped to its own least-privilege WordPress user.⌉⌊Connections: the Application Passwords that identify agents, each mapped to its own least-privilege WordPress user.⌉[ Connections: the Application Passwords that identify agents, each mapped to its own least-privilege WordPress user. [⌊The Ability Explorer: everything installed plugins let an agent do, classified by action and risk before you grant any of it.⌉⌊The Ability Explorer: everything installed plugins let an agent do, classified by action and risk before you grant any of it.⌉[ The Ability Explorer: everything installed plugins let an agent do, classified by action and risk before you grant any of it. [⌊The permission matrix: every registered Ability against one agent, set to allow, require approval, or block.⌉⌊The permission matrix: every registered Ability against one agent, set to allow, require approval, or block.⌉[ The permission matrix: every registered Ability against one agent, set to allow, require approval, or block. [⌊The approval queue: what a request asked for, how risky it is, and how long there is to decide before it expires.⌉⌊The approval queue: what a request asked for, how risky it is, and how long there is to decide before it expires.⌉[ The approval queue: what a request asked for, how risky it is, and how long there is to decide before it expires. [⌊The activity trail: every permission decision recorded with the reason it was allowed, blocked, or sent for approval.⌉⌊The activity trail: every permission decision recorded with the reason it was allowed, blocked, or sent for approval.⌉[ The activity trail: every permission decision recorded with the reason it was allowed, blocked, or sent for approval. [⌊Readiness, scored, with the evidence and the recommendation behind each check.⌉⌊ Readiness, scored, with the evidence and the recommendation behind each check.⌉[ Readiness, scored, with the evidence and the recommendation behind each check. [⌊Guided setup: six short steps, beginning with whether the site can govern an agent at all.⌉⌊Guided setup: six short steps, beginning with whether the site can govern an agent at all.⌉[ Guided setup: six short steps, beginning with whether the site can govern an agent at all. ## Installation 1. Upload the `rulefence` folder to `/wp-content/plugins/`. 2. Activate RuleFence. 3. Activation opens a guided setup that walks you through the environment check, your first agent, what it may do, and its credential. You can reopen setup any time from RuleFence > Settings > Run setup again. The full written guide is in `docs/SETUP.md`. WordPress 7.1 or later is required, because governance relies on the native Abilities execution lifecycle that 7.1 introduced. #### After setup A new agent starts paused and is allowed nothing. That is deliberate: every ability is blocked until you grant it in Abilities > Permissions. Grant a read ability first, watch it in Activity, and only then grant a write. ## FAQ ### Do I need a separate WordPress user for every agent? Use a dedicated least-privilege WordPress user for each security boundary you need to isolate. An agent is a separate RuleFence identity, but its Application Password still inherits the mapped WordPress user’s native REST capabilities. Do not map an untrusted client to an administrator. ### My agent is blocked from everything. Is it broken? No, that is the default. Governance fails closed: an ability nobody granted is refused. Grant the specific ability in Abilities > Permissions. ### Where is the Application Password shown? Once, when the connection is created. It cannot be retrieved afterwards. If it is lost, revoke that connection and issue another. ### I installed it and there is almost nothing in the Ability Explorer. Is it working? Yes, and this is worth understanding before you judge it. WordPress 7.1 registers three Abilities of its own, all read-only: core/get-site-info and core/get-environment- info need an administrator, and core/get-user-info needs only a logged-in user. So on a site with no other Ability-aware plugins there is very little for an agent to do and very little to govern. Install WooCommerce and the list grows immediately, including writes with previews and captured before-states behind them. There is a wrinkle in the meantime. An Editor mapped to an agent can reach only one of the three, while still being free to write posts through the ordinary REST API, which the permission matrix does not cover. On a stock site the safest mapping and the useful one are not yet the same thing. That is WordPress’s design rather than this plugin’s, it improves as plugins register Abilities with sensible capabilities, and it is the reason the Readiness screen scores your mapping instead of assuming it. ### Does it control everything an agent can do? It controls every Ability an agent invokes, which is what an AI client uses to work with your site. It does not sit in front of the ordinary WordPress REST API: a credential is a WordPress user, and that user’s own capabilities decide what it can reach there. So map agents to a least-privilege user and keep it that way – the Readiness screen scores this, and the connection screen warns you if you point one at an administrator. The Activity trail records every Ability decision, and outside the Abilities API it records what a managed credential changed or was refused – so a change made through an ordinary REST route still appears, attributed to the agent that made it. Successful reads there are not kept one by one, because the trail is capped and a read-heavy client would crowd out the decisions. ### What happens if an agent is compromised? Revoke its connection in Agents > Connections, or stop everything at once with Settings > Emergency mode. The record of what it already did stays intact and signed. ### Does anything leave my site? No. Agents, permissions, decisions and the audit trail are stored in your own database, and this plugin makes no outbound request of any kind – there is no webhook code in it to configure. ### Which features need the paid add-on? As many agents as you want, and everything on the governance side, are here: default- deny permissions, approvals, the signed audit trail, risk assessment, emergency mode, the readiness checks and runtime verification. The add-on sells automation and convenience – workflows, policies, undo, scheduling, export. No security control is ever sold; a control you have to buy is not a control. You do not need the add-on to use this plugin, and nothing here stops working without it. ### Does the plugin include an AI model, or send anything to one? No. It governs agents that connect to your site; it is not one, and it does not talk to any model. The AI client is whatever you connect – Claude, ChatGPT, a script of your own. ### Can it undo what an agent did? This plugin captures the before-state, so the evidence of what changed is kept whether or not you ever undo it. Performing the undo is in the paid add-on. Not everything is reversible either way, and the plugin does not claim otherwise– the Ability Explorer tells you which Abilities are covered before you grant one, so you know what a grant is worth before you make it. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “RuleFence – AI Agent Control” is open source software. The following people have contributed to this plugin. Contributors * [ RuleFence ](https://profiles.wordpress.org/wpagentmanager/) [Translate “RuleFence – AI Agent Control” into your language.](https://translate.wordpress.org/projects/wp-plugins/rulefence) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/rulefence/), check out the [SVN repository](https://plugins.svn.wordpress.org/rulefence/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/rulefence/) by [RSS](https://plugins.trac.wordpress.org/log/rulefence/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 First public release. * Every agent is a managed identity with its own credential, mapped to a least- privilege WordPress user. * A permission matrix over every registered Ability: allow, require approval, or block. An Ability nobody granted is refused. * Approvals are one-time and bound to the exact input they were granted for, so one cannot be reused for a different request. * A contextual risk engine that reads the request itself and can only make a decision stricter, never weaker. * Previews of what a write would do, before it happens. * Every decision recorded with its reason in a hash-chained audit trail that can prove it has not been edited. * Emergency controls that stop every agent, or drop the site to read-only, immediately. * Readiness scoring and 31 runtime verification checks that re-test the governance controls on the installed site rather than assuming them. * Guided setup that ends with the readiness score for the agent it just created. Development before this release was internal. No build older than this one was ever distributed. ## Meta * Version **1.0.0** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 7.1 or higher ** * Tested up to **7.1.2** * PHP version ** 8.0 or higher ** * Tags * [abilities](https://wordpress.org/plugins/tags/abilities/)[Agents](https://wordpress.org/plugins/tags/agents/) [AI](https://wordpress.org/plugins/tags/ai/)[mcp](https://wordpress.org/plugins/tags/mcp/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/rulefence/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/rulefence/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/rulefence/reviews/) ## Contributors * [ RuleFence ](https://profiles.wordpress.org/wpagentmanager/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/rulefence/)