Roles & Permissions

The capability

ChargeForms defines its own WordPress capability, chargeforms_manage_forms, rather than hardcoding a check against manage_options the way a lot of plugins do. Administrators get it automatically on install — every other role only gets it if you explicitly grant it.

Role Based access

ChargeForms → Global Settings → Permissions → Role Based lets you add or remove the chargeforms_manage_forms capability on any WordPress role. Grant it to Editor, for instance, and every user with that role can manage forms — without also handing them manage_options and everything else Administrator implies.

Every admin-side action that mutates data — creating a form, editing settings, deleting an entry — checks this exact capability plus a nonce before it does anything, the same pattern used consistently across the whole plugin.

What's not built yet

Per-user, per-form scoped permissions (an Editor who can only manage one specific form, rather than every form) aren't implemented — Role Based grants are whole-role, not form-scoped. If you need that level of granularity today, it isn't there yet; this is an honest gap, not a hidden one.