Capabilities

Capabilities are the unit of permission. Roles are just named bundles of them.

The list

Capability	Allows
content.read	Read content in lists and the editor
content.write	Create, edit, publish and trash content
media.read	Browse and read media
media.write	Upload and delete media
schema.manage	Create and edit collections and fields
plugins.manage	Install and configure plugins
users.manage	The Users screen — add, edit, remove members
roles.manage	The Roles screen — create and edit roles
*	Every capability

Role presets

Role	Capabilities
super_admin	*
staff	content.read, content.write, media.read, media.write, schema.manage, plugins.manage
partner	content.read, content.write, media.read

Notes

• content.write implies nothing about media. An editor can publish a post but not upload the image for it — grant media.write too.
• users.manage and roles.manage are separate. It is reasonable to let a manager add people without letting them invent roles.
• * is trusted. Only super admins should hold it.
• UI and API agree. A capability hides the menu item and blocks the request.