Permissions

Axmo decides who may do what with permission groups that each server sets up. Discord roles alone don’t give anyone access, not even the Administrator permission.

How it works

• Every command needs a permission: a dotted name starting with its plugin, like mod_actions.ban, cases.view or tickets.handle. A wildcard like mod_actions.* covers all of a plugin’s permissions.
• A group is a list of permissions it allows, either everywhere or in one channel or category. Groups don’t inherit from each other, so each one lists everything it allows.
• Roles are linked to groups. A member is in every group linked to one of their roles, @everyone included, and may do whatever any of those groups allows.
• If no group allows a permission, the answer is no. You can’t deny a permission, so to take something away, take it out of the group.
• The server owner may do everything.

flowchart LR
    R["Their roles"] --> G["Linked permission groups"]
    G --> P["Permissions the<br/>groups allow"]
    P --> C{"Command allowed?"}
    C -- "A group allows it" --> Y["Allowed"]
    C -- "No group allows it" --> N["Denied"]
    O["Server owner"] -- "Always" --> Y

Every permission and the groups that have it are listed on Permission nodes.

The default groups

Every server starts with four groups. Link your staff roles to the one that fits.

Group	Roughly what it allows
viewer	See cases and notes, and use /context and /jump.
helper	Everything viewer has, plus warn and mute, write notes, use workspaces and snippets, handle tickets, see appeals, investigate members, see raid mode’s actions, see scheduled actions and see their own scorecard.
moderator	Everything helper has, plus kick, ban, purge, slowmode, lockdowns, edit cases, every utility, review and decide appeals, review automod, clean up nicknames in bulk, and see insights.
administrator	Everything moderator has, plus overturn cases, manage notes and snippets, every mass action, raid mode, the ticket panel, appeal settings, and everyone’s scorecards.

What only the owner can do

None of the default groups allows these, so only the server owner can, until they add them to a group:

• /about (meta.about)
• changing automod’s settings (automod.view, automod.manage)
• deleting and restoring cases (cases.delete)
• deleting other people’s notes (notes.delete)

Some permissions can never be put in a group: the server permissions starting with guild., which cover /setup, /settings and /permissions. The * wildcard never covers them either. That way nobody can give themselves the power to change who’s allowed what.

Managing groups

Manage groups on the Permissions page of /settings. Only the server owner can change groups and link roles.

1. Pick a group with Choose group, or make one with Add group. A new group needs a name of lowercase letters, digits, - and _, and can Copy from an existing group to start with its permissions.

2. Choose what it allows. Pick a plugin with Choose plugin, then tick the permissions the group allows under Allowed here, or choose Everything in this list to allow the whole plugin. Use Channel/category to allow them in just one channel or category instead of everywhere.

3. Link roles to the group under Roles in this group. Everyone with one of those roles gets what the group allows.

Other buttons on the page:

Button	What it does
Delete group	Deletes the group. What it allows and its links to roles go too.
Add missing permissions	Gives each group named like a default group back any default permissions it doesn’t have, including ones you removed on purpose. Handy after an update adds new permissions.
Reset to defaults	Puts every group back to how Axmo sets them up, and unlinks every role.

A server can have up to 25 groups, each allowing up to 100 permissions. Every change is kept for good and posted in the Server log.

Allowing a permission in one channel

A group can allow a permission in just one channel or category. That permission then covers only that channel. Commands that act on another channel check it there too, and server-wide commands, like /lockdown server, need it everywhere.

Discord permissions as a second lock

Commands that Discord itself guards also need the matching Discord permission. These are ban, kick, mute, purge, slowmode, lockdowns, raid mode, /say and changing permissions.

Normally the Discord permission has to come from one of the member’s roles, server-wide. A channel’s overwrite can take it away but never give it.

Channel-specific permissions

Turn on Channel-specific permissions on the Permissions page to change this for /purge, /say, /slowmode and /lockdown. With it on, a Discord permission given in just one channel counts in that channel for those commands. Everything else, like bans, still needs the permission from a role.

Guards

A few more rules keep moderators from going round what they’re allowed:

• Nobody acts on someone whose highest role is the same as or above theirs.
• /role add and /mass role add won’t give out a role linked to groups that allow more than the giver may do.
• Nobody but the owner edits, overturns or deletes a case against themselves, changes its evidence, decides its appeal, changes notes about themselves, or reviews their own flagged message.
• A moderator who bans, kicks or mutes a lot of people in a short time is held off for a while, and the Moderation log says so.

Checking permissions

Command	What it does
/permissions check	Whether a member has a permission, and why.
/permissions member	A member’s permission groups and everything they may do.
/permissions log	Every change to permissions, with who made it and what it was before and after.

These need server permissions, so only the server owner can use them.

Note

Discord decides who sees a command in the menu. If someone is allowed to use a command but it’s missing from their menu, allow commands for their role under Server Settings → Integrations → Axmo.