Direct answer
Grant only the minimum command, world and management access a role needs, then review those grants regularly.
Recommended procedure
- List sensitive operations (permission edits, world file access, console access, database writes) and identify which accounts can reach them.
- Prefer narrow plugin permission nodes and separate staff groups rather than
*or unrestricted OP for routine moderation. - Remove temporary grants after testing and audit bypass nodes and inherited permissions through the permissions plugin.
Why this matters
Treat console access, operator status, remote-control credentials, and proxy secrets as privileged access. Limit them to people and systems that actually need them.
Important limitation: Web panel, SSH, RCON and database permissions are outside the Minecraft in-game permissions model and need separate access rules.
How to verify the result
- Test that a helper can complete normal moderation tasks but cannot promote themselves or modify server files.
Version and compatibility notes
- When a setting, command, or file name differs from this guide, stop and check the documentation for your exact Minecraft/server-software version instead of forcing an old example.
Official references
These sources were checked for the current MSH revision. Version-sensitive details should always be confirmed against the project documentation for the release you run.
Related guides
Help us improve this article
Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.