Context
The Data Machine admin manages per-user agent access grants through WP_Agent_Access_Store (grant_access, revoke_access, get_users_for_agent). As part of retiring Data Machine's datamachine/v1 product API (#3456), we audited agents-api's ability surface (src/Auth/register-agent-access-abilities.php) and found it exposes only the read side: agents/can-access-agent and agents/list-accessible-agents.
There is no ability surface for grant/revoke/list-for-agent, so Data Machine had to keep that logic plugin-side.
Interim
We added a single Data Machine ability, datamachine/manage-agent-access (action: list|grant|revoke, manage_agents permission, show_in_rest: true), wrapping our AgentAccess repository directly: Extra-Chill/data-machine#3473 (part of Extra-Chill/data-machine#3456)
Request
Expose grant/revoke (and list-grants-for-agent) as first-class agents-api abilities so consumers stop reaching into the access store directly:
agents/grant-agent-access — grant a principal access to an agent at a roleagents/revoke-agent-access — revoke a principal's accessagents/list-agent-access — list grants for an agent (the inverse of agents/list-accessible-agents, which lists agents for a principal)
Ownership-protection rules (e.g. "cannot revoke the owner's grant") feel like substrate policy and would benefit from living upstream next to the store rather than being re-implemented per consumer.
Context
The Data Machine admin manages per-user agent access grants through
WP_Agent_Access_Store(grant_access,revoke_access,get_users_for_agent). As part of retiring Data Machine'sdatamachine/v1product API (#3456), we audited agents-api's ability surface (src/Auth/register-agent-access-abilities.php) and found it exposes only the read side:agents/can-access-agentandagents/list-accessible-agents.There is no ability surface for grant/revoke/list-for-agent, so Data Machine had to keep that logic plugin-side.
Interim
We added a single Data Machine ability,
datamachine/manage-agent-access(action: list|grant|revoke,manage_agentspermission,show_in_rest: true), wrapping ourAgentAccessrepository directly: Extra-Chill/data-machine#3473 (part of Extra-Chill/data-machine#3456)Request
Expose grant/revoke (and list-grants-for-agent) as first-class agents-api abilities so consumers stop reaching into the access store directly:
agents/grant-agent-access— grant a principal access to an agent at a roleagents/revoke-agent-access— revoke a principal's accessagents/list-agent-access— list grants for an agent (the inverse ofagents/list-accessible-agents, which lists agents for a principal)Ownership-protection rules (e.g. "cannot revoke the owner's grant") feel like substrate policy and would benefit from living upstream next to the store rather than being re-implemented per consumer.