How to set permissions on a Minecraft server
Vanilla gives you four operator levels and nothing in between, which is why almost every server runs a permissions plugin. The job is to hand out individual abilities instead of handing out everything.
Why operator is the wrong tool
Operator is all or nothing. Level 4 gives someone /stop, /ban, world edit if it is installed, and the ability to hand operator to anyone else. There is no way to give a builder creative mode without also giving them the power to shut the server down.
A permissions plugin replaces that with named nodes. Every command and most plugin features check a node like essentials.fly or worldedit.brush.sphere, and you grant exactly the ones you mean. Operator then stays on your own account and nobody else needs it.
Installing LuckPerms
LuckPerms is the standard choice and runs on Bukkit, Spigot, Paper, Velocity, BungeeCord, Fabric, Forge and Sponge. Drop the jar in plugins, restart, and it creates a flat file storage folder with a default group already made.
Everything is driven from one command family. /lp editor opens a web editor with your whole permission tree in it, which is far easier than typing nodes, and pasting the code it gives you back applies the changes. Use it for anything more than a single grant.
Point LuckPerms at MySQL rather than flat files if you run more than one server, because that is what lets a rank bought on your survival server appear on your skyblock server without syncing files by hand.
Groups and inheritance
Do not assign permissions to players. Assign them to groups, then put players in groups. A typical ladder is default, then a few donor ranks, then helper, moderator, admin.
/lp creategroup helper
/lp group helper permission set essentials.kick true
/lp group moderator parent add helper
/lp user Notch parent add helperInheritance is what keeps this manageable. Moderator inheriting helper means a node you add to helper later reaches moderator automatically. Without inheritance you end up editing five groups every time you install a plugin, and one of them always gets missed.
Negative nodes exist too. Setting a node to false on a child group takes an inherited permission away, which is how you give a donor rank most of what a helper has without the moderation commands.
Wildcards, and why to avoid them
You can grant essentials.* or even * and be done in seconds. It is also how servers get wrecked. A wildcard grants nodes that do not exist yet, so the next plugin you install, or the next update that adds a command, silently hands that group a power you never reviewed.
The common disaster is a donor rank with a wildcard picking up an item spawning or economy command after an update. Grant nodes explicitly. The editor makes it quick enough that the wildcard is not worth it.
Per-world and per-server contexts
LuckPerms contexts let a permission apply only in certain places. Creative mode in your build world but not in survival, flight in the hub but not in the arena, and so on:
/lp group builder permission set essentials.fly true world=creativeOn a network the same idea works per server, which is how a rank can mean different things on your prison server and your skyblock server. Our network guide covers the proxy side of that.
Prefixes, suffixes and chat
LuckPerms also holds the prefix and suffix shown next to a name, set with weights so the highest weighted group wins when a player is in several:
/lp group admin meta setprefix 100 "&c[Admin] "A chat plugin reads those and renders them. Keep colour codes in the prefix rather than hardcoded in the chat format, otherwise every rank change means editing a config file. The colour code reference lists the codes and shows how a line will look.