Profiles (feature sets)

[dereuromark]

While building the wordpress implementation of djot I ran into some relevant security topics for that domain/topic.
I solved many already, but also had the question of how to address different areas and scopes:

• Admins (raw html also)
• Articles of users (non admins), no raw html, potentially no h1 header or alike if e.g. subarticle
• Comments (not even headers or other disruptive elements)

etc

I had to think if this would be pre-parse (ignore), or post-parse.
I decided to go with the latter as that allows different strategies: strip, plain text or error (e.g. in strict mode)

I created an idea of php-collective/djot-php#10

How would you solve this? Or is this solution sufficient?