Demo

A scripted agent gets a grant to edit one WordPress post, once. Then it tries to do more. Press Play, or step through it, and watch what Tokening allows and why it refuses the rest. This is a recording from a throwaway WordPress in Docker, so nothing here contacts a real site.

What you just watched:

1. The agent asks for its tools and sees only wp_update_post. Delete isn’t even on the list.
2. It edits post 2. The call fits, one use is spent, and WordPress accepts it.
3. It sends the same edit again. Refused: the only use is gone.
4. It tries post 3. Refused: the grant is bound to post 2.
5. It tries to delete post 2. Refused: the grant doesn’t include that tool.
6. Two calls arrive at the same moment on a fresh one-use grant. One wins, one is refused.

Afterwards the operator reads WordPress directly. Post 2 has the new title, post 3 is untouched and nothing was deleted.

Open the replay on its own page, run the same demo on your machine with the quick start, or read how the demo is built.