@@ -228,6 +228,33 @@ public function get_item_schema() {
 		return $schema;
 	}
 
+	/**
+	 * Restricts revision deletion to administrators.
+	 *
+	 * The inherited check only requires `delete_post` on the parent and the
+	 * revision. The singleton route is admin-managed for every other write,
+	 * so deleting revisions follows the same rule.
+	 *
+	 * @param WP_REST_Request $request Full details about the request.
+	 * @return true|WP_Error True if the request has access, WP_Error object otherwise.
+	 */
+	public function delete_item_permissions_check( $request ) {
+		$parent = $this->get_parent( $request['parent'] );
+		if ( is_wp_error( $parent ) ) {
+			return $parent;
+		}
+
+		if ( ! current_user_can( 'manage_options' ) ) {
+			return new WP_Error(
+				'rest_cannot_delete',
+				__( 'Sorry, you are not allowed to delete revisions.', 'gutenberg' ),
+				array( 'status' => rest_authorization_required_code() )
+			);
+		}
+
+		return parent::delete_item_permissions_check( $request );
+	}
+
 	/**
 	 * Checks if a given request has access to restore a revision.
 	 *
 
@@ -764,6 +764,42 @@ public function test_restore_revision_response_includes_links() {
 		$this->assertArrayHasKey( 'version-history', $links );
 	}
 
+	/**
+	 * Editors cannot delete revisions on the singleton route. The inherited
+	 * check would allow it via `delete_post`. The override locks it to
+	 * administrators to match the rest of the singleton's write policy.
+	 *
+	 * @covers Gutenberg_Content_Guidelines_Revisions_Controller::delete_item_permissions_check
+	 */
+	public function test_delete_revision_no_permission_editor() {
+		wp_set_current_user( self::$admin_id );
+		$create_response = $this->create_guidelines();
+		$post_id         = $create_response->get_data()['id'];
+
+		$request = new WP_REST_Request( 'PATCH', self::REST_BASE . '/' . $post_id );
+		$request->set_param(
+			'guideline_categories',
+			array( 'copy' => array( 'guidelines' => 'Updated.' ) )
+		);
+		rest_get_server()->dispatch( $request );
+
+		$request   = new WP_REST_Request( 'GET', self::REST_BASE . '/' . $post_id . '/revisions' );
+		$revisions = rest_get_server()->dispatch( $request )->get_data();
+
+		$this->assertNotEmpty( $revisions );
+
+		wp_set_current_user( self::$editor_id );
+
+		$request = new WP_REST_Request(
+			'DELETE',
+			self::REST_BASE . '/' . $post_id . '/revisions/' . $revisions[0]['id']
+		);
+		$request->set_param( 'force', true );
+		$response = rest_get_server()->dispatch( $request );
+
+		$this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
+	}
+
 	/**
 	 * Tests that restoring requires admin permissions.
 	 *