OpenMod Permissions & Roles

[- Alex - 36]

OpenMod Permissions & Roles
Building Maintainable Access Control
GGU Public Technical Knowledge Base

Public Knowledge Base:
This article is written for both GGU administrators and the wider server-hosting community. General instructions are platform-neutral where possible; GGU-specific practices are identified separately.

 

Applies To

• OpenMod administrators
• Server owners

 

Prerequisites

• OpenMod installed
• Access to roles configuration or permission commands

 

What You’ll Accomplish

Build a role hierarchy, understand inheritance, and grant permissions using least privilege.

 

Role-Based Permissions

OpenMod's administrator documentation uses roles as groups of permissions. Assigning a role to a user gives that user the role's effective permissions, and roles may inherit from parent roles.

 

Primary Configuration

OpenMod/openmod.roles.yaml

OpenMod also provides `permission` and `permissionrole` commands for managing access. The upstream documentation notes that changes to `openmod.roles.yaml` are applied immediately and do not require a reload.

 

Role Attributes

• Parents: other roles from which this role inherits.
• Permissions: actions explicitly granted/denied by the role.
• Display Name: human-readable role name.
• Auto Assigned: whether the role is automatically assigned to new users.

 

Designing a Hierarchy

Prefer a small number of reusable roles rather than copying the same permissions to many users. Put common permissions in a parent role and add stronger permissions only at higher tiers.

roles:
  moderator:
    display_name: Moderator
    permissions:
      - ExamplePlugin:SomePermission

  staff:
    display_name: Staff
    parents:
      - moderator
    permissions:
      - ExamplePlugin:HigherPermission

Example Only:
The exact YAML schema and permission strings depend on the OpenMod version and plugins installed. Use the plugin's registered permissions/help output as the authoritative source.

 

Least Privilege

• Grant only the permissions needed for the role.
• Avoid broad wildcards when a narrow permission is practical.
• Test denied behavior as well as allowed behavior.
• Document unusual grants.
• Remove obsolete role assignments when responsibilities change.

 

GGU Implementation Notes

GGU maps OpenMod roles to operational responsibilities rather than assuming every Leadership rank needs every game-server permission. Public examples may use GGU-style role names, but outside operators should adapt the hierarchy to their own structure.

 

Upstream References

• OpenMod Permissions
• OpenMod Developer Permissions

 

Golden Gamers United — Public Technical Knowledge Base
General guidance first. GGU implementation details second.