> For the complete documentation index, see [llms.txt](https://mango-5m.gitbook.io/mango5m-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mango-5m.gitbook.io/mango5m-docs/resources/mango-admin/configuration/roles-and-permissions.md).

# Roles and Permissions

76 permissions, four roles, and a panel that shows each person only what they may use.

Roles work the way Discord's do: somebody holds **any number** of them, their permissions are the **union**, and their limits are the **most generous** value any held role grants. Roles are edited in the panel and kept in `data/roles.json`.

## The four you start with

| Role                | Nodes | Longest ban | Shape                                                      |
| ------------------- | ----- | ----------- | ---------------------------------------------------------- |
| **Owner**           | all   | Unlimited   | Everything, including the three that grant everything else |
| **Admin**           | 64    | 30 days     | Runs the server day to day                                 |
| **Moderator**       | 39    | 7 days      | Players and reports. No economy, no resources, no weather  |
| **Trial Moderator** | 16    | None        | Observe, steady a situation, kick. Supervised              |

It is a strict ladder: a Trial Moderator can do nothing a Moderator cannot, and a Moderator nothing an Admin cannot.

## Seeing it as they see it

An owner can put on any role and use the panel as somebody with that role: **Roles → View as**, then tick the roles to wear.

Tick more than one to see what somebody holding all of them gets — permissions are the union and limits are the most generous, so two roles together are not the same as either on its own.

It is not a mock-up. The server answers every permission check as if you held only that role, so the tabs, the buttons and the ban lengths are the real ones, and anything the role cannot do is genuinely refused while you are wearing it — including editing roles.

{% hint style="info" %}
**Leaving is never part of the preview.** The bar across the top of the panel has the way out, and `/adminpreview off` works from the chat box whether or not the panel is open. A preview also ends by itself after `Config.RolePreview.maxMinutes`, and the moment you disconnect.
{% endhint %}

{% code title="shared/config/permissions.lua" %}

```lua
Config.RolePreview = {
    enabled    = true,
    maxMinutes = 60,   -- drop out on its own after this long. 0 = until you leave it
    command    = 'adminpreview',
}
```

{% endcode %}

Owners only, and the audit log records both ends of it.

## The three that stay with the Owner

Some permissions are not really permissions — they are the ability to grant yourself every other one:

| Permission          | Why it is different                                             |
| ------------------- | --------------------------------------------------------------- |
| `roles.permissions` | Decide what a role may do, including the one you hold           |
| `roles.members`     | Put anybody — yourself included — into any role, Owner included |

`roles.create` and `roles.delete` sit with them, and so does `characters.delete`. An admin having a bad day can do a great deal of damage; an admin with any of these can do all of it **and then remove the record of it**.

## Permissions for features you have switched off

A permission that only exists to gate one feature is **not offered in the editor when that feature is off**. Switch calling somebody to Discord off and `players.call` stops appearing; switch mugshots off and `players.mugshot` goes with it.

The reason is that a list of permissions for things the server cannot do is a list you have to know the history of to read. A role that already held one keeps it — it is hidden from the editor, not stripped from the role — so turning the feature back on restores exactly what was there before.

## The panel hides what you cannot use

This is not decoration. A tab you have no permission for is **not in the sidebar**, and a group heading with nothing left under it disappears with it. A button whose action you cannot run is **not drawn**, rather than drawn and disabled — a row of greyed-out buttons is a list of things somebody has been told they are not trusted with, shown to them every time they open the page.

Reaching a page another way — a link from the audit log, the back button — lands on a card naming the exact permission it needs.

{% hint style="info" %}
**Hiding is a courtesy, never the lock.** The server checks every permission again for itself when an action actually arrives. Hiding exists so the panel does not offer what it would then refuse.
{% endhint %}

## Filling roles automatically

A role can be granted to everybody in a **framework group**:

```lua
groups = { 'admin' }
```

…or to everybody holding a **Discord role** (see [Discord Integration](/mango5m-docs/resources/mango-admin/configuration/discord-integration.md)). Either way nobody has to remember to add an identifier by hand, and an existing server has its staff on day one.

## Limits

Separate from permissions, and the most generous held value wins:

| Limit         | Meaning                                                              |
| ------------- | -------------------------------------------------------------------- |
| `ban.maxDays` | The longest ban this role may issue. `-1` unlimited, `0` not allowed |

The ladder ships as unlimited / 30 / 7 / none, so a permanent ban always has an owner behind it. One number to change if that does not suit you.

## Upgrading from an older version

Permissions were split into finer ones in this version — "heal" became heal, revive and kill; "manage resources" became start, stop, restart and console. **Nothing is taken away from a role you already had.** Each old permission grants the ones carved out of it, once, the first time the new version loads your `roles.json`, and the file is stamped so it never happens twice. Roles added since are left exactly as you wrote them.

The full list of every node is in the [Permissions Reference](/mango5m-docs/resources/mango-admin/reference/permissions-reference.md).