---
title: "Admin bypass for GravityBoard permissions"
date: 2026-04-23
author: "GravityKit"
link: "https://www.gravitykit.com/docs/gravityboard/gravityboard-admin-bypass-permissions/"
---

By default, GravityBoard grants WordPress administrators and Gravity Forms administrators **full access** to every board, including permission to view, add, edit, move, and delete cards and lanes, regardless of what is selected in the board's **Permissions** tab. This article explains that behavior and how to override it for your site.

## Who is treated as an admin?

GravityBoard treats a user as an admin (and grants them full access) if they have **either** of the following WordPress capabilities:

| Capability | Typical role | Why it qualifies |

|---|---|---|
| `manage_options` | WordPress Administrator | Core WordPress capability for full site management. |
| `gform_full_access` | Gravity Forms admin | Grants unrestricted access to Gravity Forms. Users who manage forms but are not WordPress administrators will usually have this. |

If a user has at least one of these capabilities, every permission check inside GravityBoard returns `true` before the board's role settings are ever consulted.

## What does “full access” cover?

The admin bypass applies to **every** action GravityBoard permission-checks, including:

- Viewing a board and fetching its entries
- Adding, editing, moving, and deleting cards
- Adding, renaming, reordering, and deleting lanes
- Reading, creating, and deleting entry notes
- Uploading and deleting attachments
- Managing checklists and checklist items
- Voting on cards (when the Voting feature is in use)

Permissions configured in the **Permissions** tab of the board settings are still respected for every non-admin user. The bypass only affects users who hold `manage_options` or `gform_full_access`.

## Overriding the default with a filter

Developers can change which users are granted the admin bypass using the `gk/gravityboard/permissions/admin-has-full-access` filter. This filter runs inside `GravityBoard\Helpers::admin_has_full_access()` and its result is cached per user for the duration of the request, so it is safe to use on high-traffic sites.

> Not sure where to add the code samples below? See [Where to put code samples](https://www.gravitykit.com/docs/gravityview/customizing-your-views/where-to-put-code-samples/).

### Filter signature

This is the filter as defined in the plugin source (`src/Helpers.php`):

```
/**
 * Filters whether an admin user bypasses all board permission checks.
 *
 * @since 1.4.0
 *
 * @param bool $has_full_access Whether the user has full access. Default: true for admins.
 * @param int  $user_id         The user ID being checked.
 */
$has_full_access = (bool) apply_filters(
    'gk/gravityboard/permissions/admin-has-full-access',
    $has_full_access,
    $user_id
);
```

```
/**
 * Filters whether an admin user bypasses all board permission checks.
 *
 * @since 1.4.0
 *
 * @param bool $has_full_access Whether the user has full access. Default: true for admins.
 * @param int  $user_id         The user ID being checked.
 */
$has_full_access = (bool) apply_filters(
    'gk/gravityboard/permissions/admin-has-full-access',
    $has_full_access,
    $user_id
);
```

| Argument | Type | Description |
|---|---|---|
| `$has_full_access` | `bool` | Whether the user is currently considered an admin. Default: `true` if the user has `manage_options` or `gform_full_access`, otherwise `false`. |
| `$user_id` | `int` | The ID of the user being checked. |

### Example 1: Remove the bypass for everyone

Force every user, including site administrators, to obey the board's **Permissions** tab:

```
add_filter(
    'gk/gravityboard/permissions/admin-has-full-access',
    '__return_false'
);
```

```
add_filter(
    'gk/gravityboard/permissions/admin-has-full-access',
    '__return_false'
);
```

> **Warning:** After applying this filter, administrators will be locked out of any action that is not explicitly enabled for their role in each board's **Permissions** tab. Make sure to grant the appropriate roles before deploying this change.

### Example 2: Bypass only for a specific role

Grant full access to users in a custom `board_manager` role, regardless of whether they have `manage_options`:

```
/**
 * Grant full GravityBoard access to users who can manage boards.
 *
 * @param bool $has_full_access Whether the user has full access.
 * @param int  $user_id         The user ID being checked.
 *
 * @return bool
 */
add_filter(
    'gk/gravityboard/permissions/admin-has-full-access',
    function ( $has_full_access, $user_id ) {
        if ( user_can( $user_id, 'manage_board' ) ) {
            return true;
        }

        return $has_full_access;
    },
    10,
    2
);
```

```
/**
 * Grant full GravityBoard access to users who can manage boards.
 *
 * @param bool $has_full_access Whether the user has full access.
 * @param int  $user_id         The user ID being checked.
 *
 * @return bool
 */
add_filter(
    'gk/gravityboard/permissions/admin-has-full-access',
    function ( $has_full_access, $user_id ) {
        if ( user_can( $user_id, 'manage_board' ) ) {
            return true;
        }

        return $has_full_access;
    },
    10,
    2
);
```

### Example 3: Exclude specific users from the bypass

Keep the default behavior, but exclude a specific user ID from receiving full access:

```
/**
 * Exclude specific user IDs from the GravityBoard admin bypass.
 *
 * @param bool $has_full_access Whether the user has full access.
 * @param int  $user_id         The user ID being checked.
 *
 * @return bool
 */
add_filter(
    'gk/gravityboard/permissions/admin-has-full-access',
    function ( $has_full_access, $user_id ) {
        $excluded_user_ids = [ 42, 108 ];

        if ( in_array( $user_id, $excluded_user_ids, true ) ) {
            return false;
        }

        return $has_full_access;
    },
    10,
    2
);
```

```
/**
 * Exclude specific user IDs from the GravityBoard admin bypass.
 *
 * @param bool $has_full_access Whether the user has full access.
 * @param int  $user_id         The user ID being checked.
 *
 * @return bool
 */
add_filter(
    'gk/gravityboard/permissions/admin-has-full-access',
    function ( $has_full_access, $user_id ) {
        $excluded_user_ids = [ 42, 108 ];

        if ( in_array( $user_id, $excluded_user_ids, true ) ) {
            return false;
        }

        return $has_full_access;
    },
    10,
    2
);
```

## Interaction with board-level permissions

When a permission check runs, GravityBoard evaluates it in this order:

- If the selected roles for the action include the `enabled` value (“Everyone”), access is granted.
- If `admin_has_full_access()` returns `true` for the user, access is granted.
- If no roles are selected for the action, access is denied.
- Otherwise, each selected role or capability is checked against the user.

This means the admin bypass **cannot** be disabled by leaving the **Permissions** tab empty. You must use the filter above.

## Troubleshooting

### An administrator can see actions I thought were restricted

This is expected. The board's **Permissions** tab does not apply to users with `manage_options` or `gform_full_access`. Use the `gk/gravityboard/permissions/admin-has-full-access` filter to change this.

### A non-admin user cannot perform an action

Open the board settings, switch to the **Permissions** tab, and confirm the user's role is selected for that action. The admin bypass does not apply to users without `manage_options` or `gform_full_access`.

### My filter is not running

- Confirm the callback is registered **before** GravityBoard checks permissions (the `plugins_loaded` hook is a safe place).
- Remember that the result is cached per user for the request. If you are toggling the filter dynamically, clear the cache by running your test in a fresh request.
- Make sure you declared `$user_id` in the callback signature and passed `10, 2` as the priority and argument count to `add_filter()`.

## Related articles

- [GravityBoard Developer Docs (Hooks & REST API)](https://www.gravitykit.com/docs/gravityboard/developer-hooks/)
- [Troubleshooting 403 errors in GravityBoard](https://www.gravitykit.com/docs/gravitycalendar/how-to-remove-the-all-day-text-in-the-calendar-list-layout/)
- [How to Show Only Current User's Entries in GravityBoard](https://www.gravitykit.com/docs/gravityboard/how-to-show-only-current-users-entries-in-gravityboard/)

- [Where to put code samples](https://www.gravitykit.com/docs/gravityview/customizing-your-views/where-to-put-code-samples/)