Access Governance for WordPress (aka AAM)

What the author says it does

Advanced Access Manager (AAM) is an Access Governance platform for WordPress. It helps you understand and control how users, roles, applications, APIs, and other identities interact with your website.

WordPress security is not only about stopping attackers at the perimeter. Security also depends on what authenticated users, applications, integrations, and automated systems are allowed to do once they have access.

A user may have more capabilities than their job requires. An old account may still have administrative privileges. An Application Password may expose unnecessary API access. A plugin may introduce new capabilities or endpoints. An AI agent may be connected through an account with far more authority than it needs.

These are access governance problems.

AAM provides the tools to discover, define, enforce, and audit access across WordPress so you can reduce excessive privileges, prevent broken access controls, and build a security model based on the principle of least privilege.

Security starts from within.

What is Access Governance?

Access Governance is the continuous practice of answering four fundamental questions:

Who has access?

What can they access?

Why do they have that access?

Should they still have it?

In WordPress, the answers are rarely determined by a user’s role alone.

The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.

Latest changelog entry

8.0.2

• Fixed: AAM does not list draft or private posts on Posts & Terms service https://github.com/aamplugin/advanced-access-manager/issues/520
• Fixed: Potential JWT Authorization Bypass in Advanced Access Manager ≤ 8.0.1 via Omitted access_level https://github.com/aamplugin/advanced-access-manager/issues/521
• New: Login Gutenberg Block https://github.com/aamplugin/advanced-access-manager/issues/522