Minecraft anticheat guide

Permissions Audit Checklist for Minecraft Staff Ranks

Run a staff permissions audit for your Minecraft server: list ranks, review grants, remove stale access, and record who can ban, configure, or bypass checks.

Updated 2026-11-07 · ~5 min read

minecraft staff permissions auditminecraft staff rank checklistanticheat staff permissionsminecraft permission reviewstaff rank least privilege

Answer: audit ranks against the actions they actually need

Run a permissions audit each month and after every staff change. List each rank, the actions it can take, and the people who hold it. Remove permissions the role does not use, and keep bypass or exemption permissions with the smallest possible group. Save the result so the next audit has something to compare against.

Build the rank inventory

Start with a table that shows what each rank can do in each system. Fill it from the live configuration, not from memory. The columns below are a starting set. Add a column for any system that can change a player's standing on your server.

Staff rank inventory template
Rank	Ban or punish	Edit anticheat config	Bypass or exempt checks	Console or panel access
Owner	Yes	Yes	Yes	Yes
Admin	Yes	Yes	No	Limited
Moderator	Yes, tempban only	No	No	No
Helper	No	No	No	No
Build or event staff	No	No	Event-scoped only	No

Run the audit step by step

Work through these steps in order. Record each result as you go, and mark any row that you cannot verify rather than assuming it is correct.

Export the current permission assignments from each system: the permission plugin, the anticheat, the ban plugin, and the hosting panel.
Compare each rank's grants with the inventory. Flag every grant that the role does not need.
Check for grants that bypass checks, exempt players, or skip alerts. Confirm each one has a named owner and a reason.
Check for inherited permissions. A rank may gain access through a parent group that no one reviewed.
Match each staff member to one current rank. Remove people who have left, and move anyone with two ranks to the one they need.
Remove the stale grants, then reload the affected plugins as their documentation describes.
Test the change with a staff test account in staging, confirming that each rank can still do its job and nothing more.

Review bypass and exemption permissions with extra care

Bypass permissions deserve their own review. A permission that exempts a player from a check changes what your evidence means. If a player is exempt, the server cannot record an alert for that behavior, and an appeal cannot rely on it either.

Keep the list of bypass holders short. For each one, write down why the holder needs it, when it was granted, and when it should be reviewed again. Rank-based bypass rules are covered in more detail in the linked article on LuckPerms staff bypass.

Record the audit so the next one can compare

An audit only helps if the next person can see what changed. Keep the inventory, the grant list, and the list of removed access in one dated file. Note the reviewer and any open questions. Keep the record with your other staff documents so the next reviewer finds it during onboarding.

Date the record and name the reviewer.
List each removed grant with the reason.
List open items with an owner and a due date.
Set the next audit date before closing the record.

Handle temporary and event access

Give temporary access an end date when you grant it. Event staff often keep access long after the event, because nobody schedules the removal. Write the removal date in the change log, and check it during each monthly audit before you accept the rank list as current.

Set a cadence and triggers

A monthly review catches drift. Some events need an audit sooner: a staff departure, a promotion to a role with ban or config access, a plugin update that adds permission nodes, and any suspected account compromise. Treat each trigger as a reason to check only the affected ranks, unless the trigger suggests a wider problem. Keep a short written rule for who may approve a change to ban or bypass rights. The approver should not be the person who receives the permission.

What we have not verified

We have not reviewed how each permission plugin exports its data, so the export step depends on your setup. We have not tested every bypass permission in every anticheat, and this article does not claim that any specific permission is safe to grant. Read the current permission list in each plugin's documentation before you finalize the inventory.

FAQ

How many people should hold bypass or exemption permissions?

As few as possible. There is no universal number. Start with the owner and one or two people who run controlled tests, then add a holder only when a named task requires it and record the reason.

Should moderators be able to edit anticheat configs?

Usually not. Config changes alter how every player is checked, so they belong to a small admin group with a reviewed change process. Moderators can report suspected problems to that group instead.

What is the most common finding in a first audit?

Stale access is the usual result: former staff still in a group, or a temporary event permission that was never removed. Check temporary grants first, because their end dates are often missing.

Can I rely on the permission plugin's own report?

Use it as one input. A report shows grants inside that one system. Cross-check it against the hosting panel, the ban plugin, and the anticheat, because each system can grant access on its own.