# Check editorial roles before site handover

Review named users and permissions and document the ongoing owner. An editor publishes but cannot change infrastructure; a contributor drafts only.

Canonical: https://xcloud.host/use-cases/solutions/check-editorial-roles-before-site-handover/
Published: 2026-09-30 · Updated: 2026-09-30 · Technical review: 2026-09-30
Evidence: Source reviewed; no production deployment test claimed
Editorial owner: xCloud editorial

Intent: Review named users and permissions and document the ongoing owner.
For: business-owner, operator

## Requirements and responsibilities

- Have named ownership of the domain, selected xCloud team and site, and WordPress administrator access. For this scenario, agree who supplies the data and signs off: A publishing client is taking over daily editorial work. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)
- Use a compatible Nginx or OpenLiteSpeed stack for native WordPress. Verify current server resources, plan eligibility and each selected plugin or service license and requirements before installing; a Docker server does not host a new native WordPress site. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [WordPress plugin administration](https://wordpress.org/documentation/article/manage-plugins/)
- Prepare a safe test identity and a completed, accessible backup before consequential changes. The important failure to plan around is: Giving every writer administrator access increases incident scope. Sources: [Site backups in xCloud](https://xcloud.host/docs/site-backups-in-xcloud/); [WordPress hardening handbook](https://developer.wordpress.org/advanced-administration/security/hardening/)

## Illustrative situation

Illustrative scenario, not a customer case study: A publishing client is taking over daily editorial work. An editor publishes but cannot change infrastructure; a contributor drafts only.

## Choose the approach

- Verify role boundaries with named accounts before handing over access. Verify the selected provider or plugin documentation and license against this requirement; xCloud hosting does not supply its business configuration. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)
- Keep application setup, domain/DNS ownership, mail delivery and external integrations with their named administrators. Use a plain documented path when a proposed integration cannot be demonstrated end to end. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [WordPress plugin administration](https://wordpress.org/documentation/article/manage-plugins/)

## Dashboard and application procedure

### 1. List staff and the actions each role needs

**Where:** WordPress public/admin views and relevant provider evidence

**Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts.

**Inputs:** List staff and the actions each role needs; exact site identity, named approver and controlled sample data.

**Action:** List editorial staff and their expected actions: draft, edit another author's post, publish and administer plugins.

**Expected result:** A permissions matrix is ready for handover.

**Verify:** A permissions matrix is ready for handover. Record the observed site, account or transaction and time in the release sheet.

**If it fails:** If a writer needs hosting access for normal editing, reconsider the workflow.

Capability: Review a WordPress business journey
Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)

### 2. Review WordPress roles and existing accounts

**Where:** WordPress public/admin views and relevant provider evidence

**Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts.

**Inputs:** Review wordpress roles and existing accounts; exact site identity, named approver and controlled sample data.

**Action:** Inspect current WordPress accounts and roles, including shared or dormant administrators.

**Expected result:** The owner sees who can change content or site settings.

**Verify:** The owner sees who can change content or site settings. Record the observed site, account or transaction and time in the release sheet.

**If it fails:** If an unknown account exists, investigate before adding new users.

Capability: Review a WordPress business journey
Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)

### 3. Test draft, review, publish and correction journeys

**Where:** WordPress public/admin views and relevant provider evidence

**Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts.

**Inputs:** Test draft, review, publish and correction journeys; exact site identity, named approver and controlled sample data.

**Action:** Test contributor, author and editor accounts on a draft and correction. Confirm a contributor cannot publish and an editor can.

**Expected result:** Roles match the agreed approval process.

**Verify:** Roles match the agreed approval process. Record the observed site, account or transaction and time in the release sheet.

**If it fails:** If capabilities were modified by a plugin, document the effective permission instead of assuming defaults.

Capability: Review a WordPress business journey
Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)

### 4. Remove agency-only or stale credentials

**Where:** WordPress or selected plugin administrator

**Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts.

**Inputs:** Remove agency-only or stale credentials; exact site identity, named approver and controlled sample data.

**Action:** Have the authorized administrator remove stale agency credentials and add client-owned accounts only after the client proves access.

**Expected result:** No operational access is stranded.

**Verify:** No operational access is stranded. Record the observed site, account or transaction and time in the release sheet.

**If it fails:** If client login fails, restore approved access before revocation.

Capability: Configure WordPress content, users and selected plugins
Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/); [WordPress plugin administration](https://wordpress.org/documentation/article/manage-plugins/)

### 5. Document approval path and emergency access owner

**Where:** WordPress public/admin views and relevant provider evidence

**Permissions:** Named WordPress/app administrator or business owner; use authorized test accounts.

**Inputs:** Document approval path and emergency access owner; exact site identity, named approver and controlled sample data.

**Action:** Give the client an approval map and emergency contact; run a harmless draft-to-review rehearsal.

**Expected result:** Client staff can publish without agency intervention.

**Verify:** Client staff can publish without agency intervention. Record the observed site, account or transaction and time in the release sheet.

**If it fails:** If the handover test fails, retain a supported transition window.

Capability: Review a WordPress business journey
Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)

## Maintenance

- Assign a cadence for selected WordPress core, theme and plugin updates, review version-based findings and retest the path in this guide. In particular, repeat: An editor publishes but cannot change infrastructure; a contributor drafts only. A chat prompt is not a scheduled task. Sources: [Manage WordPress updates with Updates Manager](https://xcloud.host/docs/manage-wordpress-updates-with-updates-manager/); [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/)
- Record actual backup completion, storage access and responsible staff. Recheck connected application and provider behavior after changes rather than relying on a site health status alone. Sources: [Site backups in xCloud](https://xcloud.host/docs/site-backups-in-xcloud/); [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md)

## Recovery decisions

- For an access mistake, have the authorized xCloud or WordPress owner correct named roles and retest effective access. Preserve a client-controlled administrator before revoking agency credentials; database restore does not fix xCloud team membership. Sources: [xCloud team roles and permissions](https://xcloud.host/docs/team-roles-permissions-in-xcloud/); [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)

## AI handoff

Connect xCloud MCP through the current documented profile and grant only the scopes needed for the selected team. Discover tool schemas first. Read resources to plan; require approval for any supported write. Use returned dashboard URLs for manual work. The packaged REST wrapper accepts GET requests only.

### Supported scope

- **Confirm requirements and inspect resources** (mcp; read): Discover the connected profile and operation schema first; only teams granted to the connection are visible. Checkpoint: Confirm exact team, server and site identity. Use dashboard\_url returned by the resource; do not invent a dashboard link. Operation identifiers to discover: teams.index, servers.show, sites.show. Scopes: read:servers, read:sites. Sources: [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md)
- **Review a WordPress business journey** (app; manual): Application data and observed transactions cannot be inferred from xCloud resource reads. Use authorized test accounts and the application or provider evidence. Checkpoint: Record the test identity, timestamp, expected outcome, observed result and owner decision. Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)
- **Configure WordPress content, users and selected plugins** (app; manual): Requires a named WordPress administrator or suitable editor. Plugin behavior, commercial license, payment, email and external integration are verified in the chosen vendor documentation and application; xCloud hosting or MCP reads do not configure them. Checkpoint: Open the actual WordPress or selected plugin interface, record the version and role, and have the business owner accept a real user journey. Sources: [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/); [WordPress plugin administration](https://wordpress.org/documentation/article/manage-plugins/)

### Copyable agent brief

```text
Help with check editorial roles before site handover for the exact xCloud team and site I name. Read available hosting identity and state first, then ask the named WordPress, app, provider or dashboard owner for operations and records outside this connection. Prepare these authored tasks: List staff and the actions each role needs; Review WordPress roles and existing accounts; Test draft, review, publish and correction journeys; Remove agency-only or stale credentials; Document approval path and emergency access owner. The acceptance check is: No operational access is stranded. Do not infer application transactions or completed dashboard jobs from hosting resource reads. WordPress staging push/pull, backup schedule, restore and cache-setting changes require the authorized dashboard owner; the packaged REST wrapper is GET-only.
```

### Manual checkpoints

- The named WordPress, app, dashboard or provider administrator performs the guide’s actual configuration step: Test contributor, author and editor accounts on a draft and correction. Confirm a contributor cannot publish and an editor can.
- The business owner compares the controlled sample with this observable result: No operational access is stranded.
- Staging push/pull, native backup schedules, restores and cache-setting edits require the authorized xCloud dashboard operator; the packaged REST wrapper is GET-only.

## Feature coverage

- **business-acceptance** (covered): An editor publishes but cannot change infrastructure; a contributor drafts only. Steps: phase-4
- **recovery** (covered): Giving every writer administrator access increases incident scope. Steps: phase-5

## Sources

- [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md) — reviewed 2026-09-30; v4.4.2 package; xCloud v2.8.8 capability review
- [WordPress roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/) — reviewed 2026-09-30
- [WordPress plugin administration](https://wordpress.org/documentation/article/manage-plugins/) — reviewed 2026-09-30
- [Site backups in xCloud](https://xcloud.host/docs/site-backups-in-xcloud/) — reviewed 2026-09-30
- [WordPress hardening handbook](https://developer.wordpress.org/advanced-administration/security/hardening/) — reviewed 2026-09-30
- [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs) — reviewed 2026-09-30
- [Manage WordPress updates with Updates Manager](https://xcloud.host/docs/manage-wordpress-updates-with-updates-manager/) — reviewed 2026-09-30
- [Vulnerability Checker in xCloud](https://xcloud.host/docs/vulnerability-checker-in-xcloud/) — reviewed 2026-09-30
- [xCloud team roles and permissions](https://xcloud.host/docs/team-roles-permissions-in-xcloud/) — reviewed 2026-09-30

## Continue

[Explore the next WordPress workflow](https://xcloud.host/use-cases/solutions/measure-wordpress-performance-before-changing-cache/)

- [Hand over WordPress maintenance and client reporting](https://xcloud.host/use-cases/playbooks/agency-wordpress-maintenance-handover/)