Permission presets
Use actual group names and weights configured by your server. These are examples, not automatically installed groups. Avoid giving ordinary staff wrongpunish.*, which includes hierarchy bypasses and sensitive operations.
On Paper/Purpur/Folia, operators have command, bundled-template, notification, silent and scope permissions by default. The wrongpunish.* wildcard and wrongpunish.exempt/bypass permissions are not granted just by being an operator. Explicit LuckPerms grants/denials override individual defaults; unset LuckPerms permissions preserve Bukkit's calculated permissions. Proxy staff require permission grants through their proxy permissions system.
| Role | Suggested grants |
|---|---|
| Helper | wrongpunish.punish, wrongpunish.template.spam, wrongpunish.template.toxicity, wrongpunish.punish.preview, wrongpunish.warn, wrongpunish.kick, wrongpunish.history, wrongpunish.checkmute, wrongpunish.checkwarn, wrongpunish.notify, wrongpunish.unmute.own, wrongpunish.unwarn.own |
| Moderator | Helper grants plus wrongpunish.template.cheating, wrongpunish.template.advertising, wrongpunish.ban, wrongpunish.tempban, wrongpunish.mute, wrongpunish.tempmute, wrongpunish.unban.own, wrongpunish.staffhistory, wrongpunish.banlist, wrongpunish.mutelist, wrongpunish.warnlist, wrongpunish.dupeip |
| Senior moderator | Moderator grants plus full removal permissions as appropriate, wrongpunish.silent, wrongpunish.notify.silent, wrongpunish.notify.alts, wrongpunish.scope |
| Trusted administrator | wrongpunish.admin, wrongpunish.reload, wrongpunish.modify, wrongpunish.lockdown, wrongpunish.lockdown.bypass, wrongpunish.staffrollback, wrongpunish.prunehistory; sensitive address permissions only where needed |
Grant wrongpunish.ipban and wrongpunish.ipmute deliberately. wrongpunish.iphistory and wrongpunish.ipreport expose addresses and should have a smaller audience than ordinary history commands. Relationship reports themselves omit addresses.
Group-based duration limits use inherited LuckPerms groups. Without LuckPerms, grant wrongpunish.limit.helper, .moderator or .admin to select a configured preset. A permanent limit in any applicable group takes precedence; otherwise the largest matching finite limit applies.
Each template step can require a different permission. A helper allowed to use a chat template may be unable to apply its later ban step. Execution rejects that step rather than silently applying a weaker punishment. Tab completion conservatively requires all configured step permissions and does not reveal a target's offense history or reserve the next step.
The punishment GUI checks the target's actual next policy and omits templates the actor cannot execute. Its confirmation is not an authorization token; final submission rechecks permissions and policy state.
History/banlist revocation uses wrongpunish.history.revoke or .history.revoke.ban|mute|warn; warning-screen revocation uses wrongpunish.warnings.revoke. Shift-click an active item to open confirmation. Normal clicks only inspect details. The service checks current permission, state and target/issuer hierarchy before retaining the revoked record. Console-issued records require console or an explicit exemption/hierarchy bypass.
wrongpunish.history.deleted allows revoked, superseded and hidden history. The writable-book button is omitted without it. These nodes default to op on backends and are included in the explicit wildcard. /banlist requires wrongpunish.banlist; /alts permits wrongpunish.alts or wrongpunish.dupeip. Additional GUI screen/button permissions restrict access without replacing core checks.
Offline hierarchy, exemptions and Paper admission-time lockdown bypass use LuckPerms' asynchronously loaded user data. Other permissions plugins can still supply online permissions, but their offline authorization data is not inferred or fabricated.