Exercise 1: The Right Role for a Freelance Writer Publishing Only Their Own Work — Possible Solution ==================================================================== THE ANSWER: AUTHOR ------------------------------ Per this chapter's own table, Author can "publish and manage only their own posts - no access to other users' content." That matches the scenario precisely: the freelance writer needs to be able to publish directly (so Contributor, which cannot publish at all, is too restrictive) but should never touch anyone else's articles. WHY EDITOR WOULD GRANT MORE ACCESS THAN NECESSARY ------------------------------ Per this chapter's own table, Editor can "publish and manage EVERY post on the site (their own and everyone else's)... but no plugins, themes, users, or settings." The critical difference from what's actually needed here is the ability to touch every other user's posts, not just their own - exactly the capability this specific freelance writer was explicitly said not to need ("never touch anyone else's"). WHY THIS MATTERS, PER THIS CHAPTER'S OWN SECURITY REASONING ------------------------------ Per this chapter's own warn-box, "granting Administrator access 'because it's easier' instead of thinking through what a person actually needs is a genuine, common mistake," tied to the general least-privilege principle. The identical reasoning applies one level down here: choosing Editor because it's a broader, more generically "safe-sounding" role, rather than working out that Author is the precise fit, means granting real capability (editing/publishing other users' content) that was never actually required. If that account were ever compromised, or the writer made a mistake, the blast radius would extend to every other author's content rather than being contained to just their own. WHY THE PRECISE FIT MATTERS, NOT JUST "CLOSE ENOUGH" ------------------------------ Per this chapter's own decision-guide table, "a regular staff writer publishing only their own articles" is listed as the exact match for Author - this scenario is effectively that same case, just for a freelance rather than staff writer, and the correct role follows directly from matching the stated need (publish own work only) against each role's own defined boundary. WHY THIS WORKS AS AN ANSWER ------------------------------ It states the correct role and justifies it against this chapter's own precise Author definition, explains specifically which extra capability Editor would grant beyond what's needed, and ties the reasoning back to this chapter's own least-privilege security principle rather than treating the choice as arbitrary.