Most permission mistakes are not dramatic. Somebody asks for one node so they can do one thing, it gets granted, and it turns out that node includes rather more than the thing they asked about.
Grants that are effectively admin
| Node | What it really allows |
|---|---|
* | Everything, including commands from plugins you install next year. |
<plugin>.* | Every command that plugin has or will ever have, administrative ones included. |
Anything granting /op | They can promote themselves and anyone else, permanently. |
| World editing | Reshaping or deleting any part of the world, faster than any griefer. |
/gamemode for creative | Unlimited items, which is your economy and your item scarcity gone. |
/give or item spawning | The same, more directly. |
| Permission-plugin commands | They can grant themselves whatever they were not given. |
If somebody can edit permissions, every other restriction on this page is advisory. They cannot be limited by permissions, because they control permissions. That node belongs to you and to nobody else, regardless of how much you trust them for everything else.
Auditing what you have already given
- List your groups and read them out loud
Not the interface, the actual node list. Wildcards hide inside groups that were set up in a hurry a year ago.
- Look for wildcards first
Anything ending in
.*deserves a second look, and*on its own deserves removal unless the group is you. - Check inherited groups
A moderator group inheriting from a builder group that has world editing is a common and invisible route to more power than intended.
- Test as a member of each group
A second account in the group tells you what it can really do. Reading the config tells you what you meant it to do.
Writing out six individual permissions takes two minutes once. A wildcard takes ten seconds and quietly expands every time the plugin updates. The two-minute version is the one you can still reason about in a year.
No group except your own contains a bare wildcard, and a test account in your highest staff group cannot grant itself anything.