Control custom post type visibility with permission rules
A permission rule decides whether POM Theme displays supported content for the current visitor. A custom post type can use a rule for its single entries and optionally show a fallback template when access is denied.
Permission rules control theme presentation. They do not change WordPress roles or capabilities, protect REST API fields, or replace authorization in another plugin.
Define the audience first
Write the expected result for each visitor state before creating a rule:
| Visitor | Expected single-entry result |
|---|---|
| Logged-out visitor | Public content, fallback, or not found |
| Allowed role | Protected content |
| Other logged-in role | Fallback or not found |
| Qualifying customer or subscriber | Protected content |
Purchase and subscription conditions appear only when the corresponding WooCommerce extension is active. Those conditions require a logged-in visitor whose account can be evaluated.
Create a named rule
- Open Settings → POM Theme → Content model → Permission rules.
- In Rules, choose Add permission rule.
- Enter a clear top-level Rule name.
- In the nested Rules group, choose Add condition.
- Name the condition and select its Rule type.
- Complete the roles, products, purchase date, or subscription settings shown for that condition.
- Add further conditions only when the audience requires them.
- Set Condition between sub-rules:
- AND requires every condition to pass.
- OR allows any condition to pass.
- Save the settings.
The always-available condition types are Role is and Role is not. Depending on the active WooCommerce extensions, the list can also include product-purchase checks, purchase-date checks, subscription-product checks, subscription-status checks, and subscription-date checks.
A rule with no usable conditions does not restrict display. Always add and verify at least one condition before assigning the rule.
Assign the rule to a post type
- Open Settings → POM Theme → Content model → Post Types.
- Edit the required item under Custom Post types.
- Select the saved Permission rule.
- Optionally choose a Permission rule fallback template.
- Save the settings.
When a visitor fails the assigned rule, POM Theme uses the selected fallback template. Without a fallback, the single request returns a not-found result.
Verify every branch
Use a published representative entry and test in separate sessions:
- Visit while logged out.
- Visit with each role referenced by the rule.
- Visit with a logged-in role that is not referenced.
- For commerce rules, test both qualifying and non-qualifying customer accounts.
- Confirm the protected template, fallback template, or not-found result matches the audience table.
- Confirm archives, search results, APIs, feeds, and third-party integrations expose only what their own configuration permits.
If every visitor can see the entry, confirm the post type has the correct Permission rule selected and the rule contains a condition. If every visitor is denied, simplify the rule to one known condition and verify it before restoring AND combinations.
Review permission behavior again whenever roles, WooCommerce products, subscriptions, or the fallback template change.