Multisite: Add Network Setting and capabilities to restrict Connectors management on subsites

[lenasterg]

Summary
In WordPress 7.0 Multisite installations, AI Connectors are enabled by default on subsites, any user with the administrator role on a subsite can manage, overwrite, or remove active API keys and integrations.
The superadmin needs to use plugins or custom code to hide the Settings->Connectors screens from the subsites.

Current Behavior

1. No Network Toggle: There is currently no option in Network Admin settings to globally disable Connectors across all subsites.
2. Incomplete Constant Behavior: Setting define('WP_AI_SUPPORT', false); in wp-config.php disables core AI features network-wide, but does not hide or disable the subsite Settings > Connectors screen.
3. Confusing Permission Notice: When plugin administration is disabled for subsite admins (standard Multisite behavior), visiting Settings > Connectors displays the notice *"You do not have permission to install plugins. Please ask a site administrator to install them for you."*, despite the user already being a site administrator.
4. Unrestricted Modification: Any subsite Administrator can freely delete, or replace active API key of the subsite and save changes.
5. Key Masking: The API key input on subsite screens is properly masked, which successfully prevents plaintext exposure/theft of secrets between subsite administrators.

The Problems

1. Lack of Network Control & "As-a-Service" Use Case:

Network Admins currently have no global setting to control or disable Connectors on subsites (unlike Plugins, which can be managed network-wide). This creates two major architectural issues:

• Super Admins cannot completely disable AI Connectors across the network if company, security, or privacy policies (e.g., GDPR) dictate doing so.
• Super Admins can't provide API/AI integrations as a centralized service ("AI as a Service"), because they cannot provide network-provided keys, or per subsite and protected them from being overwritten by subsite admins.

2. UX Friction / Broken Flow: If a Super Admin has disabled plugin management permissions for subsite administrators (the standard Multisite setup), a subsite admin visiting the Connectors screen wil see the notice You do not have permission to install plugins. Please ask a site administrator to install them for you. This creates a confusing user experience for subsite administrators.

3. On multisite networks where subsites have multiple Administrators (e.g., client admins, external agencies, or departmental leads), any subsite admin can inadvertently or intentionally break an active connector integration established by another subsiteadmin by removing or replacing the API key.

Proposed Solutions to discuss / Enhancements

• Option A (Network Administration Setting): Add a global toggle under Network Admin > Settings (similar to Plugins management) allowing Super Admins to enable/disable Connector management permissions for subsite administrators altogether.
• Option B (Capability Check): Introduce a specific capability (e.g., manage_connectors) so Network Admins can control whether subsite administrators can modify existing connections.
• Option C (Read-Only State): Allow subsite Administrators to view the status of a Connector, but restrict editing/updating the API key strictly to the admin who initially configured it. So having a user - API key combination.

Steps to Reproduce

Part 1: UX Friction / Broken Permission Flow Notice

1. Set up a WP 7.0 Multisite environment.
2. Add define('WP_AI_SUPPORT', false); to wp-config.php and notice that Settings > Connectors is still accessible on subsites.
3. Under Network Admin > Settings, ensure plugin administration is disabled for subsite admins (uncheck "Enable administration menus: Plugins").
4. Create a subsite and assign a user with the administrator role.
5. Log in as a subsite Administrator (who is not a Super Admin) and navigate to Settings > Connectors.
6. Notice the prompt: "You do not have permission to install plugins. Please ask a site administrator to install them for you." (A confusing message since the user is a site admin, but lacks network plugin capabilities).

Part 2: Multi-Admin Overwrite

7. Log in as Super Admin and Network Activate the required connector plugin so that the API configuration screen becomes active on subsites.
8. Create a subsite and assign two distinct users with the administrator role (e.g., Admin_A and Admin_B).
9. Log in as Admin_A, navigate to Settings > Connectors, enter an API key, and save.
10. Log in as Admin_B on the same subsite and navigate to Settings > Connectors.
11. Notice that while the key is masked, Admin_B can easily delete/replace it and save, breaking Admin_A's integration without any network policy preventing it.

Related blog post exploring subsite Connector permissions and potential workarounds: ​https://lenasterg.wordpress.com/2026/06/05/wordpress-7-0-multisite-did-you-notice-the-new-connectors-screen-in-subsites/