> For the complete documentation index, see [llms.txt](https://daddy-studios.gitbook.io/daddy-studios-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://daddy-studios.gitbook.io/daddy-studios-docs/scripts/daddy-admin/permissions.md). # Roles & Permissions Access is managed in game. `server.cfg` ACE groups and jobs are not used, so nobody becomes staff by being in `group.admin`. The server checks the role on every action, so a modified client cannot skip it. {% hint style="warning" %} Updating from 1.x resets the staff list and roles once. Claim owner again with the code from the server console. {% endhint %} ## Owner While the server has no owner, the resource prints a one-time code to the server console at start. 1. Join the server and type `/adminclaim`. 2. Enter the code. You are owner, the code stops working. No owner can get in? Type `daddyadmin_newcode` in the server console for a fresh code, or use `setadmin owner` there. ```lua Config.Claim = { Command = 'adminclaim', -- in-game command that opens the code prompt Digits = 6, -- length of the code (6 to 12 digits) MaxAttempts = 5, -- wrong codes per player before a temporary lock LockMinutes = 10, MaxTotalAttempts = 20, -- wrong codes in total before the code is cancelled } ``` ## Roles The owner creates roles on the **Staff** page, switches permissions on for each role and gives every staff member one role. A role has: * a **level** from 1 to 99. Staff can only act on (kick, ban, freeze, ...) people below their own level. The owner role is level 100, holds every permission and cannot be edited. * a set of **permissions**. Each permission unlocks a group of related actions, for example "Kick players" or "Manage owned vehicles". Changes apply at once, also for staff who are online. Anything they may no longer use (noclip, godmode, spectate, ESP, live screen) is switched off. Giving someone a role first shows which permissions they gain and lose. ## Who can manage roles A role with **Manage staff and roles** can create roles and assign people, but only below its own level and only with permissions it holds itself. Only an owner can make another owner, and the last owner cannot be removed. ## Owner only The Lua console, the server terminal and scheduled console commands can never be given to a role, because each of them is full control of the server (`Config.OwnerOnlyActions`). ## Editing the permission list `config/permissions.lua` lists every permission and the actions behind it. You can move actions between permissions or split one up: ```lua Config.Permissions = { { id = 'players_kick', domain = 'players', risk = 'high', actions = { 'players.kick' }, implies = { 'players.list' } }, { id = 'players_jail', domain = 'players', risk = 'high', actions = { 'quick.jail' }, implies = { 'players.list' } }, -- ... } ``` Labels are in the locale files (`ap.bundle.`). `Config.BaseActions` are held by every staff role. ## Two-person approval Chosen actions wait until a second staff member approves them. Owners skip the approval. ```lua Config.Panel.Approvals = { Enabled = false, Actions = { 'bans.permanent', 'devtools.server_exec', 'money.large', 'mass.giveMoney', 'inventory.clear' }, Thresholds = { PermanentBanMinutes = 525600, -- bans this long (1 year) count as permanent Money = 1000000, -- one money change at or above this needs approval MassMoneyTotal = 500000, -- mass payouts whose total reaches this }, } ``` An emptied inventory can be restored once from its log entry. ## Sensitive identifiers IPs, Discord ids and full licenses are masked for roles without the sensitive identifiers permission (bans, activity, economy, tickets, signals). ## Console | Command | What it does | | --------------------------------------------- | ----------------------- | | `setadmin ` | Give a role | | `removeadmin ` | Remove from staff | | `daddyadmin_newcode` | New one-time owner code | `setadmin` and `removeadmin` also work in game for staff who may manage roles. {% hint style="info" %} Other resources decide their own access. If your `server.cfg` gives a group `command allow`, everyone in that group can still run every server command, including ones from other resources. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://daddy-studios.gitbook.io/daddy-studios-docs/scripts/daddy-admin/permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.