Permissions & Roles

Bots need to enforce who can use commands.

Permission types:

• User: bot's owner only (admin commands).
• Server admin: who has admin role in the channel.
• Role-based: specific roles can use specific commands.
• Channel restricted: only in certain channels.

Role hierarchy:

• Owner > admins > moderators > members.
• Each role has bitfield of permissions.
• Bot inherits permissions of its assigned role.

Bot's own permissions:

• Bots have permissions like users.
• Can't kick if no kick permission, etc.
• Check before attempting action.

Commands checks:

• Before parsing args: check if user can use the command at all.
• After parsing: check action-specific (e.g., target must be lower role).

Decorators:

Audit logging:

• Record who ran what privileged command.
• Available in audit channel.

Modern Discord:

• Slash commands have built-in permission system.
• Define default_member_permissions per command.
• Per-server overrides via UI.
• Bot doesn't need to check; platform enforces.

Telegram:

• Less granular. Bots get message; check sender ID against admin list.

Misuse:

• Test that admin actions actually require perms.
• Don't let unauthorized users escalate.
• Validate input (target user, target channel).