Audit user accounts and roles

The administrator list is the one place on a WordPress site where a forgotten account matters most. Old contractors, a spare admin someone made for a one-off, a plugin’s service account nobody remembers. Before you change anyone’s access, it helps to see the whole roster laid out: who holds which role, who can do the most damage, and who has not touched the site in years.

This is the orientation prompt for your users. It reads the accounts and hands you a briefing, and it cannot touch a single one.

Give me a read-only audit of the user accounts on this site. Change nothing.

Up top I want a count of users by role. Then list every administrator by name
and email so I can eyeball who has full access. Then flag the accounts that
look worth a second look: administrators with zero published content, accounts
registered a long time ago that may belong to people who have moved on, and any
role I would not expect to see.

Lay it out as a short briefing I can skim in under a minute, and put a one-line
takeaway at the very top: the single account or pattern most worth acting on.

Why this is safe to run

Both abilities behind this prompt are reads. Listing users is gated by the list-users capability, so the agent only sees the roster if the account you bound it to is allowed to, and neither read can promote, demote, create, or delete anyone. The reads return display name, email, roles, post count, registration date, and bio, and never a password or any auth secret.

This pairs naturally with the offboarding and cleanup recipes: run the audit first to see who is actually there, then decide, deliberately, whether any account needs a role change or removal as a separate approved step.

Already connected? Skip the paste. Ask your agent for the “audit user accounts and roles” recipe, or just ask it who has access to your site, and it runs the same reads on your own install.