We’re pleased to announce the release of Advanced Permissions for Gravity Forms version 4.0.
This is our largest release since Advanced Permissions 3.0, and it’s built around one idea: the permission rules you set up on a form should follow that form’s data everywhere it goes. With 4.0, your Form Permissions and Entry Permissions now apply inside GravityView and Gravity Wiz Entry Blocks, across the Gravity Forms REST API, to AI agents working through the Gravity Forms MCP server, and, when you want them to, even to Administrators. And because agents are becoming a real part of how sites get managed, 4.0 also lets you manage your permission rules themselves through a new set of MCP tools.
Permissions in GravityView and GP Entry Blocks
GravityView and GP Entry Blocks are two of the most popular ways to display Gravity Forms entries on the front end of a site, and until now, an entry that was hidden from a user in the WordPress dashboard could still appear in a View or an Entries block.
Advanced Permissions 4.0 changes that. Once a logged-in user is covered by an Entry Permissions ruleset, that ruleset filters what they see in GravityView, including single entry pages, lightboxes, CSV downloads, and GravityView’s REST output, as well as in every GP Entry Blocks Entries block. If a form’s rules hide an entry from a user in the entry list, that entry is hidden from them on the front end, too.
Form Permissions apply here as well. A user who isn’t allowed to edit or delete a form’s entries can’t edit or delete them from a View or an Entries block, and GravityView’s approve, moderate, and duplicate entry actions honor the same rules. A user who has been explicitly denied the View Entries capability for a form won’t see the View render at all.
There’s nothing new to configure. If you already have rulesets on a form, they now apply to GravityView and GP Entry Blocks automatically.
Permission Rules Now Apply to the REST API
The Gravity Forms REST API is how a growing number of sites connect Gravity Forms to other applications, whether through application passwords, custom integrations, or headless front ends. In previous versions, permission rules only governed the WordPress dashboard, which meant a user with API access could potentially see forms and entries the rules would otherwise hide from them.
In 4.0, permission rules apply to every Gravity Forms REST API v2 request. Form, entry, feed, and note collections are limited to what the requesting user is permitted to see, Entry Permissions apply to individual entry endpoints, and editing a form through the API is governed by that form’s ruleset. A user with restricted Entry Permissions on a form is refused access to that form’s results endpoint, so aggregated results can never expose entries they aren’t allowed to view.
As with GravityView and GP Entry Blocks, this happens automatically based on the rulesets you’ve already configured.
Permission Rules Now Apply to AI Agents
Gravity Forms recently introduced support for the WordPress Abilities API, which powers its MCP server and lets AI agents like Claude and ChatGPT work with your forms and entries. Those agents act as a WordPress user, and in 4.0, they’re governed by that user’s permission rules just like the dashboard and the REST API.
When an agent lists forms, reads entries, or works with feeds through the Gravity Forms MCP tools, the results are limited to what the connected user is permitted to see, and Entry Permissions apply to the entry tools. An agent can’t be used as a side door around the rules you’ve configured.
Manage Permissions with AI Agents
Enforcement is only half of the story. Advanced Permissions 4.0 also registers its own set of MCP tools, so an agent connected to your site can help you manage your permission rules, not just work within them.
Five new tools let an agent list the Gravity Forms capabilities Advanced Permissions can manage, read a form’s Form Permissions or Entry Permissions rules, and replace them, including the default Form Permissions ruleset applied to new forms. That means you can ask an agent to do things like “restrict Form 5 so only Editors can view its entries” or “show me who’s allowed to edit the contact form,” and have it read or update the same rulesets you’d manage from the Permissions tab.
Every change goes through the same validation as the permissions UI, and only users who are allowed to manage permissions can use the tools. They’re also off by default: an administrator has to enable them under Forms → Settings → MCP before an agent can use them. To help agents use the tools well, the release includes a downloadable agent skill that teaches Claude how Advanced Permissions rules work.
The MCP tools require WordPress 6.9 or greater and the Gravity Forms MCP server.
Apply Permission Rules to Administrators
One of the most frequent requests we’ve received is the ability to restrict what Administrators can do in Gravity Forms. This is especially common on client sites, where the client needs the Administrator role to manage the rest of WordPress but shouldn’t be able to change every form.
Advanced Permissions 4.0 makes this possible. Exemption from permission rules is now controlled by a WordPress capability, forgravity_advancedpermissions, rather than being tied to the Administrator role itself. That capability is granted to the Administrator role automatically, so nothing changes when you update. When you’re ready to govern Administrators, remove the capability from the role using a plugin like Members or User Role Editor, and Administrators can then be targeted by rules like any other role. Super Admins on multisite installations always remain exempt.
Smarter Bulk Actions on the Form List
We’ve also made a smaller change you’ll notice right away. On the Forms list, bulk actions that you aren’t allowed to perform on the forms you’ve selected, such as Trash or Delete, are now disabled in the Bulk Actions menu instead of appearing available and failing later.
Rebuilt Under the Hood
Advanced Permissions 4.0 also includes the most significant update to the plugin’s foundation since it was first released. The engine that resolves which form a request belongs to, decides which capabilities apply, and builds the Gravity Forms admin menu has been rebuilt from the ground up. It’s designed to fail closed, so when a permission can’t be determined, access is denied rather than granted, and it’s backed by a comprehensive automated test suite that runs against Gravity Forms, GravityView, GP Entry Blocks, and the other add-ons Advanced Permissions integrates with.
You’ll see the results of this work in a number of fixes throughout the release, including the form editor’s Preview button now respecting the Preview Forms capability, the main Entries page correctly landing on a form the user has access to, and Entry Permissions now applying correctly when printing entries.
For developers, this release introduces three new filters: advancedpermissions_user_is_exempt for programmatically exempting users from permission rules, advancedpermissions_user_capabilities for adjusting a user’s capabilities after rules have been applied, and advancedpermissions_form_id_for_object for resolving which form an entry or other object belongs to during capability checks.
Take Control of Who Can Do What in Gravity Forms
Advanced Permissions gives you granular, per-form control over what your users can see and do in Gravity Forms. Decide who can edit forms, who can view or export entries, which entries each role or user is allowed to see, and who can manage add-on feeds, all from a single Permissions tab on each form. With 4.0, those decisions are enforced consistently across the dashboard, the REST API, your front-end entry displays, and the AI agents connected to your site.
Release Notes
- Added Advanced Permissions MCP tools for the Gravity Forms Abilities API: agents can list the manageable capabilities and read or replace the Form Permissions and Entry Permissions rules of a form (requires WordPress 6.9+ and the Gravity Forms MCP settings). Includes a downloadable agent skill.
- Added support for enforcing permission rules on the Gravity Forms Abilities API (MCP tools). Forms, entries and feeds are limited to what the user is permitted to see, and Entry Permissions apply to entry abilities.
- Added support for enforcing permission rules on Gravity Forms REST API v2 requests. Forms, entries, feeds and notes are limited to what the user is permitted to see, and Entry Permissions apply to entry endpoints.
- Added support for applying permission rules to Administrators. Users with the forgravity_advancedpermissions capability (granted to the Administrator role by default) and multisite Super Admins are exempt from rules.
- Added GravityView integration. Entry Permissions filter the entries shown in Views (including single entry, lightbox, CSV and REST output) and Form Permissions govern editing, deleting, duplicating and approving entries.
- Added GP Entry Blocks integration. Entry Permissions filter the entries shown in Entries blocks and Form Permissions govern editing and deleting entries.
- Added disabling of form list bulk actions the user cannot perform on the selected forms.
- Added the advancedpermissions_user_is_exempt, advancedpermissions_user_capabilities and advancedpermissions_form_id_for_object filters.
- Updated the permissions engine with a rebuilt capability, request resolution and menu layer, backed by a full automated test suite.
- Deprecated User::is_immune() in favor of User::is_exempt().
- Fixed an issue where an entry ID passed to current_user_can() for an entries capability was treated as a form ID.
- Fixed an issue where Entry Permissions were not applied when printing entries.
- Fixed an issue where the form editor Preview button was displayed to users who were denied the preview forms capability.
- Fixed an issue where the main Entries page could redirect to the wrong form for users without access to the first form.
- Fixed an issue where the user role drop down in the field conditional logic flyout was rendered with an unparsed placeholder in its id and name attributes.
- Fixed an issue where users could not print entries for forms they have permission to view entries for.
