> For the complete documentation index, see [llms.txt](https://atiysus-organization.gitbook.io/aty-scripts/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://atiysus-organization.gitbook.io/aty-scripts/zone-creator/getting-started/permissions.md).

# Permissions

Access to the panel (and to sensitive actions) is checked **on the server** every time — the client is never trusted.

### Who can open the panel?

Detection runs in this order (first match wins):

1. **ACE permission** — `command.zonecreator`
2. **QBCore permission** — one of `Config.QBPermissions` (default `admin`, `god`)
3. **ESX group** — one of `Config.ESXGroups` (default `admin`, `superadmin`)

#### ACE (framework-agnostic)

```cfg
add_ace group.admin command.zonecreator allow
```

You can also grant it to a single player by identifier:

```cfg
add_ace identifier.license:xxxxxxxx command.zonecreator allow
```

### Role tiers (badge + action gate)

Each admin is resolved to a **role** shown as a badge in the panel and used to gate actions. Mapping lives in `Config.Roles`:

| Framework | Detected value → role                                         |
| --------- | ------------------------------------------------------------- |
| QBCore    | `god → superadmin`, `admin → admin`, `mod → moderator`        |
| ESX       | `superadmin → superadmin`, `admin → admin`, `mod → moderator` |
| ACE       | `zonecreator.role.<role>` (e.g. `zonecreator.role.admin`)     |

#### Action requirements

Most actions need only **moderator**. Sensitive ones require a higher tier and are configured in `Config.ActionRoles`:

```lua
Config.ActionRoles = {
    kick = 'admin', ban = 'admin', kill = 'admin', zoneban = 'admin',
}
```

The **bulk** actions and **delete** require **superadmin** by default (see the `can()` tiers in the panel). Anything not listed is allowed at moderator level.

{% hint style="warning" %}
Because the gate is server-side, a lower-tier admin who tries a higher-tier action gets a `"… requires <role> role"` notification and nothing happens — even if the UI button was reached.
{% endhint %}

### Commands

| Command        | Who                | What                                                                                                                 |
| -------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------- |
| `/zonemanager` | Admins (per above) | Opens the management panel. The command name is `Config.Command`.                                                    |
| `/zonehud`     | Everyone           | Toggles the player-facing restriction HUD. Players can also rebind the key (default **F7**, `Config.Hud.toggleKey`). |