Giving an Editorial AI Agent Permission to Fix One Article

Say an agent helps look after a few publications. Today’s job is small: tighten the opening paragraph of one article. It doesn’t need to touch other articles, change categories or publish anything. With a normal WordPress application password it could do all of that. With a grant it can do the job and nothing else.

Here’s how that looks in practice. The setup below follows what Tokening 0.1 supports. Your own WordPress MCP plugin decides the exact tool name and fields, so check its tool list before you copy anything.

Set it up once

Declare one target per site in the policy and store each site’s application password in Tokening’s vault. Add a text-edit template that allows wp_update_post, binds the post ID at issue time and accepts only title and content with length limits. Leave additional_args on refuse, so a stray status or categories field is turned away.

Issue a grant per article

tokening grant issue wp.edit-post-text \
  --bind id=4812 --uses 1 --ttl 15m \
  --to copy-editor --by me \
  --reason "tighten the opening paragraph"

The agent gets the grant secret. That’s its whole permission for today.

A good order of work

Agents do better with a plan than with a race against the clock. Have the agent read the article and propose the new paragraph first, using a read-only tool or a separate read grant. Look at the proposal. If you like it, issue the edit grant and let the agent send one call with the change.

If title and body both need to change, put them in that one call. A one-use grant won’t wait for a second thought.

What gets refused

An edit aimed at another article fails the post binding. A call that also sets status is refused as an extra field, so fixing prose never quietly publishes a draft. A second edit after the first one is refused because the use is gone. Every refusal has a reason the agent can read and you can find later in the log.

What still needs you

Tokening checks which post and which fields. It doesn’t read the paragraph. An allowed edit can still be wrong, so the review step above matters. Keep the real application passwords out of the agent’s environment, too. The grant only helps if the agent has no other way into the site.

The WordPress demo shows the same pattern on a throwaway site, and how it works covers what happens on each call.