You granted the node, the plugin shows it, and the player still cannot use the command. Permissions have more moving parts than they look like they do, and these five cover almost every case.
The five causes
- They are op, or you are
Operators bypass permission checks in most plugins, which means a negated permission does nothing to them. If you are testing on yourself and you have op, you are not testing permissions at all.
- A negative node is winning
Most permissions plugins let you deny a node as well as grant it, and a denial in an inherited group beats a grant further down. Check the whole inheritance chain, not just the group you edited.
- The context is wrong
Per-world and per-server contexts mean a node can be granted in a place the player is not. This is the one that looks completely correct in the interface.
- The plugin caches permissions
Some plugins read a player's permissions once on join. A node granted while they are online does nothing until they reconnect.
- The node is not the one you think
essentials.homeandessentials.homesare different, and a wildcard may not cover a subcommand. Copy the node from the documentation rather than typing it from memory.
Fast checks
| Check | Tells you |
|---|---|
/lp user <name> permission check <node> | Whether the plugin thinks they have it, and why |
| Deop yourself and retry | Whether op was masking the real answer |
| Have them reconnect | Whether the plugin was caching |
| Test in the world it should apply to | Whether context is the problem |
Granting * or a broad plugin.* to a trusted group hands out every command that plugin will ever add, including ones from future updates you have not read about. It also usually includes the administrative commands. Grant nodes individually; it is more typing once and less regret later.
A check command tells you what the permissions plugin believes. Logging in on a second account and running the command tells you what actually happens, which is occasionally different and always more convincing.
A test account in the intended group uses the command in the intended world, and cannot use it anywhere it should not.