Module — 3 operations
The moderation queue: list by status, approve, hold, spam or trash, and reply beneath a comment.
Nothing extra to install. This module runs on core WordPress alone.
A reply is authored by the acting WordPress user and posted approved. There is no anonymous or impersonated comment path.
Everything here asks for moderate_comments — the same permission the site’s own moderation screen asks for.
A read still asks WordPress for a capability against the object. There is no anonymous read anywhere in the surface.
content-read
Lists comments by status, post, or search term, newest first
needs moderate_comments
Every one of these is previewed before it runs, snapshotted before it changes anything, and verified afterwards by reading the site back. The chips are the policies the operation itself declares.
content-write
Approves, holds, spams, or trashes one comment
needs moderate_comments
content-write
Posts an approved reply beneath one comment, authored by the acting user
needs moderate_comments