Feat/add role user access controls

[Infinite-Null]

Closes: #736

Description

This PR introduces Feature-Level Access Controls exclusively for Editor Experiments, allowing site administrators to restrict access to individual AI-powered editor features based on specific WordPress roles or individual users.

Testing Instructions

1. Navigate to AI Settings and enable Enable AI.
2. Open the Developer Tools menu (three dots) and select Access controls.
3. Under the "Editor Experiments" section, verify that the Roles and Users configuration panel appears beneath the feature toggles.
4. Check a few roles (e.g., Editor, Author) for a specific feature and click Save. Verify the save is successful.
5. In the Users field, search for a specific user and select them from the dropdown. Click Save.
6. Refresh the page and verify that your selected roles and users persisted and display their correct names.
7. Turn off "Access controls" from the Developer Tools menu, and verify that all selections are cleared.
8. Verify Enforcements: Log in to the site as a user who does not possess the selected role and is not the selected user. Open the block editor and verify that the restricted experiment is not accessible or visible to them.
9. Log in as the specifically selected user or a user with the granted role, and verify the feature is fully accessible.
10. Turn off "Access controls" from the Developer Tools menu, and verify that all selections are cleared and the feature becomes globally available again.

Screencast

User: Ankit Shah | Role: Editor

Screen.Recording.2026-06-22.at.1.35.17.PM-compressed.mp4

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Sonnet 4.6
Used for: Validating bug, suggesting a fix.

Changelog Entry

Add - Role and User based access controls for experiments

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: Infinite-Null <ankitkumarshah@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>
Co-authored-by: dkotter <dkotter@git.wordpress.org>
Co-authored-by: henryperkins <htperkins@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[codecov]

Codecov Report

❌ Patch coverage is 86.27451% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.78%. Comparing base (d9f9697) to head (d3312b2).

Files with missing lines	Patch %	Lines
...iments/Alt_Text_Generation/Alt_Text_Generation.php	12.50%	7 Missing ⚠️
includes/Settings/Settings_Registration.php	92.30%	4 Missing ⚠️
...eriments/Comment_Moderation/Comment_Moderation.php	80.00%	1 Missing ⚠️
.../Content_Classification/Content_Classification.php	50.00%	1 Missing ⚠️
.../Experiments/Content_Resizing/Content_Resizing.php	50.00%	1 Missing ⚠️
...es/Experiments/Editorial_Notes/Editorial_Notes.php	75.00%	1 Missing ⚠️
...xperiments/Editorial_Updates/Editorial_Updates.php	50.00%	1 Missing ⚠️
...eriments/Excerpt_Generation/Excerpt_Generation.php	50.00%	1 Missing ⚠️
.../Experiments/Meta_Description/Meta_Description.php	80.00%	1 Missing ⚠️
...cludes/Experiments/Suggest_Reply/Suggest_Reply.php	66.66%	1 Missing ⚠️
... and 2 more

Additional details and impacted files

@@              Coverage Diff              @@
##             develop     #749      +/-   ##
=============================================
+ Coverage      75.63%   75.78%   +0.15%     
- Complexity      3381     3409      +28     
=============================================
  Files            138      139       +1     
  Lines          13129    13273     +144     
=============================================
+ Hits            9930    10059     +129     
- Misses          3199     3214      +15     

Flag	Coverage Δ
unit	75.78% <86.27%> (+0.15%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jeffpaul]

@Infinite-Null FYI some merge conflicts to resolve to keep this moving along

[Infinite-Null]

I’ve addressed all the feedback and updated the PR accordingly. Thank you so much for taking the time to review it and for the detailed feedback.

Whenever you get a chance, could you please take another look.

cc: @jeffpaul @dkotter

[jeffpaul]

1. I'm not seeing this as available on the Image Generation and Editing feature.
2. I think we can remove Subscriber as a role listed as none of these would be exposed for those folks anyway (perhaps Contributor as well?).
3. I think we should probably expose these for the Comment Moderation and Suggest Reply experiments as well. Otherwise maybe add a note to the Admin Experiments text that notes that all experiments unless otherwise specified are scoped to admins-only?

[Infinite-Null]

Hi @jeffpaul, Thanks for the feedback! I’ve updated the PR accordingly. I’ve also removed both Subscriber and Contributor from the listed roles.

[Infinite-Null]

The failing tests seem to be unrelated to the changes introduced in this PR.