Roles and Permissions
Core Tables uses 4 WordPress capabilities. Activation gives them to administrators and editors, and every other role can still use published datasets in posts.
The Capabilities
| Capability | Lets a user |
|---|---|
edit_core_tables | Open the Core Tables screen, create datasets and edit their own |
publish_core_tables | Publish and unpublish datasets they can edit |
export_core_tables | Export datasets they can edit |
manage_core_tables | Edit every dataset, plus the site-wide settings and admin-only tools |
What Each Role Can Do
| Role | Capabilities | What they can do |
|---|---|---|
| Administrator | All 4 | Everything, on every dataset: Appearance, AI & MCP, License, Import from plugins, Google Sheets setup, revision cleanup and permanent delete |
| Editor | Edit, publish and export | Create datasets, then edit, publish, unpublish, export, trash and restore their own. They can refresh a connected Sheet but not set one up |
| Author and Contributor | None | Insert Core Table and Core Chart blocks and choose published datasets. They can’t open the dataset editor |
| Visitors | None | See published public columns and download the CSV when it’s allowed |
Dataset Ownership
The user who creates a dataset owns it. Editors only see and edit datasets they own, both on the Datasets screen and in the block’s dataset picker.
Administrators see and edit every dataset. There’s no setting to change a dataset’s owner, so a dataset an editor created stays with that editor.
Using Datasets in Posts
Any user who can edit posts can insert the blocks and pick a published dataset. The Edit data button only appears when that user can also edit the dataset.
Users with edit_core_tables also get Show datasets I can edit in the picker. It includes unpublished drafts, though only published data ever appears on the site.
Custom Roles
The capabilities are ordinary WordPress capabilities. A role editor plugin can give them to a custom role, such as a “Data editor” role with edit_core_tables and publish_core_tables.
AI and API Access
AI tools and the REST API follow the same rules, because they run as the WordPress user who connects. One exception is worth knowing: the 2 published-data abilities, list-published and query-published, only need the basic read capability. Any logged-in user, subscribers included, can call them for published public data. Abilities and MCP lists every ability with its permission.
For a step-by-step walkthrough, see How to Update One Table Across Many Posts at Once.