Discord permissions explained: how they combine and which ones are dangerous

Discord permissions are switches attached to roles. A member can do everything that any of their roles allows — permissions add up, and the server-wide list has no “deny”. Each channel can then override that with channel permissions (allow, deny or inherit) for specific roles or members. Administrator skips all of it: whoever has it can do everything, everywhere, no matter what a channel says.

A handful of permissions can wreck a server in a minute: Administrator, Manage Server, Manage Roles, Manage Channels, Manage Webhooks, Ban and Kick Members. This guide explains how the system calculates what someone can do, rates every major permission by risk, gives safe setups for helpers, moderators and bots, and shows how to audit your server — then how BotGG’s anti-nuke and role safeguards back it up.

How Discord permissions combine

Discord works out a member’s permissions in a fixed order. Once you know it, most “why can they see that channel?” questions answer themselves.

1. Server permissions: roles add up

Every member has the @everyone role, plus any roles you give them. Their server-wide permissions are the sum of all of them. If @everyone can send messages and a Helper role adds Manage Messages, a helper has both. There is no way to remove a permission at the server level with another role — if one role grants it, the member has it.

That makes @everyone your baseline: whatever it can do, every new account can do — including the alt of someone you just banned.

2. Channel permissions override the server list

In a channel’s settings → Permissions, you can set each permission to allow (✓), deny (✗) or inherit (/) for a role or a single member. Discord applies them in this order, and later steps win:

1. The member’s server permissions (all roles added up).
2. The channel’s @everyone overwrite.
3. All role overwrites for roles the member has, combined: denies first, then allows. If one of their roles is denied and another is allowed, allow wins.
4. The member-specific overwrite — the strongest one.

That’s why “Muted” roles built from channel denies are fragile — Discord’s Timeout is more reliable: a timed-out member can only read.

Two implicit rules help too: without View Channel, every other permission in that channel is meaningless; and without Send Messages, a member can’t attach files, embed links or mention @everyone there either.

3. Administrator and the owner bypass everything

The server owner and every member with Administrator have all permissions in every channel; overwrites don’t apply to them. Administrator isn’t “a lot of permissions” — it’s the absence of limits, so never hand it out for convenience.

4. Categories and synced channels

A channel inside a category can be synced with it: it uses the category’s overwrites, and changing the category changes the channel. The moment you edit a synced channel’s own permissions, it stops being synced and keeps its own copy. Later changes to the category no longer reach it — a common reason a “locked” category still has one open channel. The channel settings show whether it’s synced, with a button to sync it again.

5. Hierarchy limits who can manage whom

Role position doesn’t change channel permissions, but it limits power: a member (or bot) with Manage Roles can only edit and assign roles below their own highest role, can’t grant permissions they don’t have themselves, and can only kick, ban or time out members whose highest role is lower than theirs. The Discord roles guide covers ordering roles in detail.

Every major permission and how risky it is

Rule of thumb: Critical belongs to the owner and one or two co-owners, High to trusted staff with 2FA (only what their job needs), Medium is fine for helpers, Low is the normal member set.

Safe permission setups for staff and bots

A few habits make these setups hold:

• Turn on 2FA for moderation. In Server Settings → Safety Setup, the owner can require two-factor authentication for moderator actions. Members without 2FA then can’t ban, kick, delete messages or manage channels, even if their roles allow it.
• Give private channels access with overwrites, not with powerful roles. A Staff role can be allowed into #staff-chat without any server permission at all.
• Bots get a managed role. When you add a bot, Discord creates a role with the permissions you approved on the invite screen. Uncheck anything you don’t want before you click Authorize, and check the role afterwards — you can edit its permissions like any other role. Remember that whoever can add bots (Manage Server) can bring in an account with any permission they hold themselves.

How to audit your server’s permissions

Do this after every staff change and every few months anyway:

1. Server Settings → Roles. Open each role, look for the Critical and High permissions and ask who still needs them.
2. Check @everyone first. Templates and old setups sometimes leave Manage Messages or Mention @everyone switched on for everybody.
3. Use “View Server As Role” (in the role’s menu in Server Settings → Roles) to see the server exactly as a Member or Helper sees it.
4. Open your private channels’ permissions. Look for allows on broad roles and member-specific overwrites you forgot about, and resync channels with their category where they should match.
5. Server Settings → Integrations. Remove bots you no longer use and review each bot’s role. Here you can also limit who can use each bot’s commands, per role and channel.
6. Server Settings → Members. Filter by role to see who actually holds the powerful ones — especially inactive accounts.

How BotGG handles dangerous permissions

Anti-nuke watches for dangerous permissions

BotGG’s anti-nuke has an instant trigger for exactly the permissions that enable a takeover. When someone who isn’t trusted gives a role Administrator, Manage Server, Manage Roles, Manage Channels, Manage Webhooks, Ban Members, Kick Members, Manage Expressions, Mention @everyone or Timeout Members — or hands a role like that to a member — anti-nuke acts at once instead of waiting for a mass deletion. By default it quarantines the account, then reverts what it can: the dangerous permissions come off the edited role and the dangerous role is taken back.

Trusted means the owner, BotGG and the users or roles you list — a trusted role only counts after it has been held for ten minutes, and giving someone a trusted role is itself an instant trigger. Restoring a quarantined member’s roles asks for an extra confirmation when any of them carries dangerous permissions. Auto-restore of deleted channels and roles from your latest backup is included free. The anti-nuke guide walks through the full setup.

BotGG won’t hand out roles that are too powerful

Many BotGG features give roles automatically: role menus, level and invite rewards, shop items, verification, accepted applications, game roles, Flows “add role” steps. If anyone with Manage Server could set an Administrator role as a reward, the console would be a back door. So when you save such a setting, the console checks the role:

• Too powerful — if the role has any of the takeover permissions above, or Manage Messages, Manage Threads, Manage Nicknames, Manage Events, Mute, Deafen or Move Members, or View Audit Log, saving is refused. Only the server owner or a member with Administrator can allow it, by adding the role to Privileged roles in Bot settings.
• Above you — you can only wire up roles below your own highest role, the same rule Discord applies when you assign roles by hand. The owner is exempt.

The bot checks again when it actually gives the role, so a role that gained a dangerous permission later still isn’t handed out.

Moderation follows the same idea from the other side: you can set mod roles so staff use /warn, /timeout, /kick and /ban through BotGG instead of holding raw Discord permissions. BotGG still checks that the target ranks below them, every action becomes a numbered case in the mod log, and anti-nuke counts kicks and bans made through BotGG under the moderator’s own name.

BotGG’s own permissions: no Administrator

BotGG’s invite link (https://discord.com/oauth2/authorize?client_id=1553367772451446804&scope=bot%20applications.commands&permissions=282970448981207) asks for a fixed list of permissions, and Administrator is not on it:

Not requested: Administrator, Manage Server, Manage Webhooks, Manage Expressions, Manage Nicknames, Mute and Deafen Members. A bot with Administrator is a master key: if its token ever leaked, the attacker would hold every permission and no overwrite would stop them. With a specific list, Discord’s safeguards apply to BotGG like to any member.

Two consequences: BotGG can only manage roles and members below its own role, so drag its role above your staff roles; and without Manage Webhooks, anti-nuke reports webhooks an attacker created instead of deleting them — grant it yourself if you want that. If anything is missing, the console’s Bot permissions card says what, with a button to re-invite BotGG with the recommended set.

FAQ

What are the most dangerous Discord permissions?

Administrator, Manage Server and Manage Roles are critical; Manage Channels, Manage Webhooks, Ban, Kick, Timeout, Mention @everyone and Manage Expressions are high-risk. Keep them on as few roles as possible and require 2FA for moderation.

Does a channel deny override a role allow?

Between roles, no: if one of a member’s roles is allowed and another is denied in the same channel, allow wins. Only a member-specific deny beats a role allow, and nothing beats Administrator.

Why can a member see a channel I denied?

Usually one of their other roles has an allow on that channel, they have a member-specific allow, or they hold Administrator. Check with “View Server As Role” and the channel’s permission list.

Does my bot need Administrator?

Almost never. A bot needs the permissions its features use. BotGG works without Administrator; if a bot insists on it, give it a specific list instead and check its role after inviting.

Is BotGG’s anti-nuke free?

Yes. Anti-nuke — including the dangerous-permission trigger, quarantine, revert and auto-restore from backups — is part of the free plan.