The following pages document how to use return value of the has_permission() method:

• https://github.com/WordPress/abilities-api/blob/v0.1.1/docs/2.getting-started.md
• https://github.com/WordPress/abilities-api/blob/v0.1.1/docs/4.using-abilities.md

This method can return a WP_Error or a boolean, so a check like if ( $ability->has_permission( $input ) ) does not do what is expected. A WP_Error instance will evaluate to true and cause this logical check to unexpectedly pass.

The WP_Ability::execute() method correctly handles a WP_Error being returned by the permissions check.

There are a few options.

• Adjust has_permission() to only return a boolean, so it behaves more like a traditional capability check function such as current_user_can().
  • Can be combined with retaining the existing method under a different name.
  • Can be combined with throwing an exception. Not very WordPress-y.
• Retain everything as-is but update all the developer documentation to include checks for is_wp_error(). I think this is risky, it's too easy for a developer to implement a simple boolean check and therefore incorrectly handle a WP_Error.