Permissions

The parent node

ecstacy.admin grants every node in the table below. It does not grant ecstacy.exempt.*: that is deliberate and covered at the bottom of this page.

Nodes

All of these default to op.

ecstacy.alerts.reputation is separate and configurable. It controls who receives low-reputation alerts, and the node itself is set in settings.yml under reputation.alerts.permission.

Nodes not declared in plugin.yml

These are enforced by their commands but not declared as permissions, so they fall back to the server's default for undeclared nodes: operators have them, ordinary players do not.

If you use a permission manager, grant these explicitly rather than relying on operator status.

Exemption

Operators being scored is intentional: it is how staff verify that the anticheat is working, on themselves, without disabling anything. If a specific player is never flagged, the first thing to check is whether a permission group granted them this node.

Per-check exemptions are managed at runtime instead of through permissions:

/ecstacy exempt Notch              # show what Notch is exempt from
/ecstacy exempt Notch CrystalAura  # toggle one check
/ecstacy exempt Notch *            # toggle all checks

Prefer these to the permission. A per-check exemption is visible in game, reversible from the same command, and leaves the other families scoring the player. ecstacy.exempt.* sits in your permission plugin where nobody thinks to look, and removes the player from everything at once.

Suggested groups

There is no single right split, but these four cover most staff structures. LuckPerms syntax; adapt to whatever you run.

Helper: sees flags, cannot change anything.

lp group helper permission set ecstacy.notify true
lp group helper permission set ecstacy.alerts true
lp group helper permission set ecstacy.player true
lp group helper permission set ecstacy.playerinfo true
lp group helper permission set ecstacy.violations true
lp group helper permission set ecstacy.feedback true

Moderator: helper, plus the tools to act on a flag.

lp group mod parent add helper
lp group mod permission set ecstacy.spectate true
lp group mod permission set ecstacy.suspicious true
lp group mod permission set ecstacy.replay true
lp group mod permission set ecstacy.logs true
lp group mod permission set ecstacy.reputation true

Admin: everything except exemption and reputation resets.

lp group admin permission set ecstacy.admin true
lp group admin permission set ecstacy.doctor true
lp group admin permission set ecstacy.profiler true
lp group admin permission set ecstacy.reputation.reset false

Owner: the full set, including the nodes that are not declared in plugin.yml.

lp group owner permission set ecstacy.admin true
lp group owner permission set ecstacy.doctor true
lp group owner permission set ecstacy.profiler true
lp group owner permission set ecstacy.exempt.manage true

Note that none of these grant ecstacy.exempt.*. That is the point.

Auditing exemption

If a player is never flagged while everyone around them is, exemption is the first thing to rule out. Not the check.

/ecstacy exempt <player>

with no check name lists what that player is currently exempt from. If it comes back empty, the per-check exemptions are clear and the next suspect is the permission node:

lp user <player> permission info
lp group <their-group> permission info

Look for ecstacy.exempt.* anywhere in the inherited tree. A wildcard grant such as ecstacy.* in a permission plugin will also pick it up, which is the usual way it ends up set by accident. ecstacy.admin will not, because the node is deliberately not one of its children.