Hi Gavin

We already use the inbuilt wordpress capabilities to manage the access control. The below code is used to inject the minimum capabilities for all wordpress roles and also to create a new role 'Anonuymous user' with miminum capabilities to access online events/contribution/profile pages, when civicrm hook is activated.

register_activation_hook( __FILE__, 'civicrm_activate');

function civicrm_activate() {
    // Assign minimum capabilities for all wordpress roles and create anonymous_user' role
    civicrm_wp_set_capabilities();
}

/*
* Function to create anonymous_user' role, if 'anonymous_user' role is not in the wordpress installation     
* and assign minimum capabilities for all wordpress roles
*/
function civicrm_wp_set_capabilities() {
    global $wp_roles;
    if (!isset($wp_roles)) {
      $wp_roles = new WP_Roles();
    }
 
    //Minimum capabilities (Civicrm permissions) arrays
    $min_capabilities =  array(
      'make_online_contributions' => 1,
      'profile_create' => 1,
      'profile_edit' => 1,
      'profile_view' => 1,
      'register_for_events' => 1,
      'view_event_info' => 1,
    );
 
    // Assign the Minimum capabilities (Civicrm permissions) to all WP roles
    foreach ( $wp_roles->role_names as $role => $name ) {
      $roleObj = $wp_roles->get_role($role);
      foreach ($min_capabilities as $capability_name => $capability_value) {
        $roleObj->add_cap($capability_name);
      }
    }
 
    //Add the 'anonymous_user' role with minimum capabilities.
    if (!in_array('anonymous_user' , $wp_roles->roles)) {
      add_role(
        'anonymous_user',
        'Anonymous User',
        $min_capabilities
      );
    }
}

And the capabilities/permissions are checked for the roles in the check function as below

 /**
   * given a permission string, check for access requirements
   *
   * @param string $str the permission to check
   *
   * @return boolean true if yes, else false
   * @static
   * @access public
   */
 public static function check($str) {
    // for administrators give them all permissions
    if (!function_exists('current_user_can')) {
      return TRUE;
    }

    if (current_user_can('super admin') || current_user_can('administrator')) {
      return TRUE;
    }

    // Make string lowercase and convert spaces into underscore
    $str = strtolower($str);
    $str = str_replace(" ","_",$str);

    if ( is_user_logged_in() ) {
      // Check whether the logged in user has the capabilitity
      if (current_user_can($str)) {
        return TRUE;
      }
    }
    else {
      //check the capabilities of Anonymous user)
      $roleObj = new WP_Roles();
      if ($roleObj->get_role('anonymous_user') != NULL && array_key_exists($str, $roleObj->get_role('anonymous_user')->capabilities)) {
        return TRUE;
      }
    }
    return FALSE;
  }

Please review the functions and let me know if i am doing anything wrong.