> For the complete documentation index, see [llms.txt](https://stellarskills.gitbook.io/stellarskills-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://stellarskills.gitbook.io/stellarskills-docs/permissions-and-security.md).

# permissions and security

The client only renders and requests. The server verifies editor sessions, class access, rank/cost, version, transactions, and choices. Keep authoring and command-reward configuration restricted to trusted administrators.

## Built-in permission paths

### Player-default paths

```
stellarskills.menu
stellarskills.tree.view
stellarskills.tree.allocate
stellarskills.tree.refund
stellarskills.profile
stellarskills.plan
stellarskills.client
stellarskills.fallback
stellarskills.classes
```

### Administrator paths

```
stellarskills.admin
stellarskills.admin.edit
stellarskills.admin.publish
stellarskills.admin.balance
stellarskills.admin.level
stellarskills.admin.reset
stellarskills.admin.reload
stellarskills.admin.migrate
stellarskills.admin.audit
stellarskills.admin.trace
stellarskills.admin.backup
stellarskills.admin.class
```

### Restricted bypass paths

```
stellarskills.bypass.cost
stellarskills.bypass.requirement
```

The code registers these paths under NeoForge namespace `stellar_skills`. Providers that expose namespace-qualified names may list them as `stellar_skills.stellarskills.admin`, for example. Inspect your provider's actual registered node names before granting permissions; the shorthand paths above are not proof of how every provider names a node.

`permissions.yml` lists the paths for reference; editing that file is not a permission provider. Without a provider, player-default nodes resolve true and admin nodes use operator level 2. Bypass nodes resolve false even for operators.

## Safe delegation

Give a content author the root menu/admin permission and `admin.edit`. Give `admin.publish` only to people allowed to activate content. Keep balance/level/reset/audit/backup/trace/class powers separate where your provider supports them.

A class's own `permission` is another availability requirement. For custom permission perks, native StellarSkills permission queries and command-provider grants have different scopes; see [effects](file:///4985688/configuration/effects.md).

## Bypass requires two opt-ins

```yaml
allocation:
  allow-cost-bypass: false
  allow-requirement-bypass: false
```

To bypass, both the relevant switch and the relevant granted permission must be true.

{% hint style="warning" %}
Do not enable either while validating the economy with an operator account, or your tests may no longer represent ordinary players.
{% endhint %}

## Authoring protection

Every operation checks player identity, session token, tree, expiry, expected revision, allowed operation, and typed data. Publication revalidates the full graph/pack. Invalid drafts cannot replace the live snapshot. Sessions do not accept arbitrary paths, Java code, or replacement YAML from clients.

{% hint style="warning" %}
Permission effect command templates and enabled Journey reward commands are explicitly server-authoritative execution features. A trusted editor who can configure them can create powerful outcomes. Do not treat typed packets as a sandbox that makes arbitrary configured commands harmless.
{% endhint %}

## Audit and backups

Audits record mutations and actor/reason details; only authorized staff should inspect them. Packaged general audit/retention fields are policy descriptors; do not assume a retention value implements automatic cleanup for every database table. Back up configuration **and** database/player data; editor revisions only cover content files.

Security checks do not replace protection mods, good administrative permissions, SQL credential hygiene, or a staging test of new content.