Permissions decide who can do what on your Minecraft server. Before you pick a plugin or memorize commands, it helps to understand the model underneath: how the built-in operator system works, what a permission node actually is, and how groups and inheritance turn a pile of individual permissions into clean staff and player ranks. This guide explains those concepts so the setup steps make sense later. When you are ready for the hands-on walkthrough, the LuckPerms setup guide covers the actual commands.

What Server Permissions Are and Why Ops Are Not Enough

A permission is a single yes-or-no flag that controls access to one action, one command, or one feature. When a player runs a command or a plugin checks whether they can do something, the server looks up whether that player holds the matching permission. Vanilla Minecraft has almost no granularity here. Out of the box you get the operator (op) system, and that is essentially all-or-nothing: an op can run most server commands, and a non-op cannot.

That model falls apart the moment your server has more than one type of person on it. You might want a moderator who can mute and kick but cannot stop the server or hand out items. You might want a VIP rank that unlocks /fly and a few cosmetic commands without any moderation power. You cannot express any of that with ops alone, because op is a single switch with no middle ground. Real servers need to grant narrow slices of access, and that is exactly what a permission system provides. If you only need to make a couple of trusted players full admins, the guide on adding ops to a Minecraft server covers that simpler path.

Operator (Op) Levels 1 to 4

The vanilla op system is slightly more nuanced than a single on or off. When you op a player you assign them an operator level from 1 to 4, set by the op-permission-level option in server.properties (default 4). Each level is cumulative: a higher level includes everything below it.

  • Level 1: can bypass spawn protection. The lightest tier, with no command access beyond that.
  • Level 2: can use most single-player cheat commands, such as /gamemode, /give, /tp, and edit command blocks. This is the level command blocks themselves run at.
  • Level 3: adds multiplayer management commands like /kick, /ban, and /op for other players.
  • Level 4: full control, including /stop to shut the server down. This is what a normal /op grants by default.

These levels are still coarse. They bundle dozens of commands together and offer no way to grant one without the rest, and they only cover vanilla commands, not the commands that plugins add. That is the ceiling of the built-in system, and it is why most servers reach for a permissions plugin.

Permission Nodes, Wildcards, Groups, and Inheritance

A permissions plugin replaces the coarse op switch with fine-grained permission nodes. A node is a dot-separated string that names one specific capability. Plugins define their own nodes, so EssentialsX gates flying behind essentials.fly, kicking behind essentials.kick, and banning behind essentials.ban. You grant a node to allow the action and deny it to block the action. Each plugin documents its node list, usually on a Permissions page in its wiki.

Because nodes share that dotted structure, you can target whole families at once with a wildcard. The node essentials.* grants every EssentialsX permission, and a bare * grants everything on the server. Wildcards are powerful and easy to over-apply, so a common pattern is to grant a wildcard and then explicitly deny the few nodes you want to hold back. Denies take precedence over grants, so the block always wins over the broad allow.

Assigning nodes to players one at a time would be unmanageable, so permissions are organized into groups. A group is a named bundle of nodes, such as default, vip, moderator, or admin. You add a player to a group and they receive every node that group holds. A player can belong to several groups at once, and their effective permissions are the merge of all of them.

Groups become genuinely powerful through inheritance. You can make one group a parent of another so the child automatically receives all of the parent's nodes. If admin inherits from moderator, every moderator permission flows up to admin for free, and you only add the extra nodes that make admin more powerful. This keeps your ranks layered and avoids copying the same nodes into multiple groups. The mental model is simple: nodes are the atoms, groups bundle nodes, and inheritance stacks groups into a ladder of access.

The Permission Plugin Landscape

Several plugins implement this node and group model, but they are not equal in 2026.

LuckPerms is the modern standard. It is actively maintained, works on every major platform (Paper, Spigot, Fabric, Forge, Velocity, BungeeCord), stores data in a local H2 database or in MySQL for multi-server networks, and ships a visual web editor so you can manage groups without typing every command. It also integrates cleanly with EssentialsX and Vault. If you are choosing a permissions plugin today, this is the one to use.

GroupManager and PermissionsEx (PEX) are the older options you will still see referenced in dated tutorials. GroupManager bundled with the long-deprecated Essentials suite, and PermissionsEx was the dominant plugin years ago but is no longer actively developed for modern versions. Both still teach the same node and group concepts, but neither is recommended for a new server. If you find a guide that tells you to install PEX or GroupManager, treat the concepts as valid and substitute LuckPerms for the actual tooling.

When to Use Plain Ops vs a Permissions Plugin

You do not always need a plugin. Plain ops are fine when your server is tiny and everyone with elevated access is fully trusted, for example a private survival world for you and a couple of friends where everyone is an admin anyway. In that case op levels alone save you from installing anything.

Reach for a permissions plugin as soon as you need tiers: donor or VIP ranks, a moderation team with limited power, per-group chat prefixes, or any command-by-command control over what players can do. The threshold is essentially whether one global on or off switch can express your staff structure. The moment the answer is no, a permissions plugin is the right tool, and LuckPerms is the one to install.

Next Step: Set It Up

Now that the concepts are clear, the practical work is short. On a NetSkyway server you have full SFTP and panel access with no restricted plugin list, so you can drop in a permissions plugin and configure it yourself in minutes. For the exact commands to create groups, assign nodes, set up inheritance, and use the visual editor, follow the LuckPerms setup guide, which walks through the entire process step by step.