Access Model SOP: Roles vs Per-Object

Access Model SOP: Roles vs Per-Object
WordPress role tiers vs granular per-object capabilities. Match to org size.

— Use built-in roles (Editor, Author, Contributor) when: under ~10 users and responsibilities map cleanly to tiers.
— Use a capability manager (Members, custom roles) when: you need to grant edit-others-posts without full admin, or split a role's powers.
— Use per-object/ACL plugins only when: specific users must touch specific pages and nothing else. Heavier to audit, so document every grant.
— Never give Editor unfiltered_html or admins-by-default: that's a stored-XSS vector for non-trusted authors.
— Verify: list users by role quarterly, demote anyone whose job changed.

Run this every time you add a user.