Seeing only "write" there we may need to prefix the category? But then might take too much space... or could we group them by category name? Or maybe it's just renaming the name of the "Write" category now to "Tag Manager Write". I guess also the other capabilities may not be clear what they refer to unless you hover the tooltip. At the same time I like the compact style.

Do we also need ability to set capabilities when giving access to all websites? Maybe not needed for now?

Seeing only "write" there we may need to prefix the category? But then might take too much space... or could we group them by category name?

Didn't know there was a category, will see what it looks like.

Do we also need ability to set capabilities when giving access to all websites? Maybe not needed for now?

I'm not sure (cc @mattab). I guess if it's ok to just add Capability: ... to the dropdown, then it would be pretty simple to do.

We could also show capabilities one on each row, and perhaps make the list expandable so you'd only see:

capability 1
capability 2
see more

until clicking 'see more'.

Having one on each row looked pretty good, but it did make the rows a lot bigger.

Not sure what it would look like... would it be possibly by default show kind of as regular text no capabilities if none, or the assigned capabilities as words if some are granted Tag Manager: Write, Publish Live Container. So Category: capabilities, Category: Capabilities. It would be only one row because Tag Manager is the only plugin defining it so far.

This only viewing what the current state is. To assign them, we could have behind each page an edit /expand button? I know it could be quite painful when wanting to grant many capabilities to many sites, but for this we also have the bulk actions... and I reckon those capabilities are very rarely used. So personally I'd be fine with that.

Or maybe we could somehow use chips which are a bit more efficient?

Chips might work if we combine it w/ a dropdown (ie, instead of the user typing in a new chip, the blank chip is a select w/ the list of available capabilities).

If a capability is included in a role, we could show it w/ the remove icon disabled. Will try it.

I just remember we have this UI field as well in Custom Reports called expandable-select.

<div piwik-field uicontrol="expandable-select" name="..."
                             full-width="true"
                             ng-change="editReport...."
                             title="..."
                             ng-model="editReport.report...."
                             options="editReport....">
                        </div>

not sure if that maybe is useful?

Could help, thanks!

@tsteur changed to use chips + added capabilities to add access to all sites + to bulk actions. screenshot:

Looks good 👍