AICOM 3.8.6 is a small release on the surface, but it touches one of the most important parts of working with AI agents inside WordPress: permissions.
When an AI assistant connects to a website, it does not always need to change things.
Sometimes it only needs to look.
It may need to understand how a multilingual site is structured. It may need to inspect WooCommerce products before preparing a draft update. It may need to understand how Elementor content is built before suggesting changes.
That sounds simple, but it matters.
Because reading and writing should not always be the same permission.
Read-Only Access for Real WordPress Workflows
AICOM 3.8.6 adds new read-only scopes for Polylang, WooCommerce, and Elementor.
This means an AI agent can inspect data from these integrations without automatically receiving permission to change that data.
For example, an assistant can understand the language setup of a Polylang site, review WooCommerce information, or inspect Elementor-related content before doing anything more sensitive.
This is the kind of detail that makes AI automation feel safer in practice.
Not every task starts with “change this.”
Many tasks start with “look at this carefully, understand the current state, and then help me decide what to do next.”
AICOM 3.8.6 makes that workflow easier to support.
Clearer Permissions When Access Overlaps
There is also a small interface improvement in the Connect AI Agents form.
When a manage scope is selected, the matching read scope now shows a small “included automatically” note.
It is not a flashy change. It is not the kind of thing that gets a big headline.
But it is exactly the kind of thing an admin needs when deciding what an AI agent is allowed to do.
If write access already includes read access, the interface should say that clearly.
Permissions should not feel mysterious. They should feel visible.
Why This Matters
AICOM is not trying to make WordPress more chaotic by adding AI on top of everything.
The goal is the opposite.
AI agents should be able to help with WordPress work while staying inside clear boundaries. They should have keys. They should have scopes. Their actions should be controlled. And when possible, they should get the minimum access needed for the task.
That is why read-only scopes matter.
They let an assistant understand more of the website without immediately becoming more powerful than it needs to be.
For developers, agencies, and site owners, this creates a more practical workflow. You can let an agent inspect the site, prepare suggestions, compare content, review structure, or understand context without jumping straight to full modification rights.
The Previous Steps
The last few releases have been moving in the same direction.
AICOM 3.8.5 fixed an audit log issue where fresh installs could miss the session_id column, leaving the Activity tab empty. Existing installs are repaired automatically on update.
That release also introduced AICOM-Only Mode, available from the Safety page and off by default. When enabled, it can block Application Passwords, XML-RPC, and unsigned REST writes, so AI agents can only modify the site through AICOM.
Before that, AICOM 3.8.4 improved the MCP handshake. The plugin now responds correctly to initialize, notifications/initialized, and ping, making it easier for stricter MCP clients to connect.
The onboarding wizard also became simpler, with a General option marked as Recommended for MCP-aware agents.
A Small Release With a Clear Direction
AICOM 3.8.6 is not about adding a big new screen or a dramatic new workflow.
It is about tightening the system.
More precise scopes. Clearer permission behavior. Better separation between reading and writing. Less guessing for the person setting up the agent.
That is the direction AICOM is moving in.
Not AI with unlimited access.
Not another dashboard full of noise.
A safer bridge between WordPress and the AI tools people are already starting to use.