Permissions

Administration

Permission	Default	Grants
daisyfilter.admin	op	Parent for admin actions; includes status, gui, test, alerts, export, inspect, notes, monitor, and the three punish profiles that default to op. Also required for everything that weakens filtering: allow, unallow, rule enable|disable, filters reset, and the equivalent GUI buttons.
daisyfilter.status	op	status, version.
daisyfilter.gui	op	Opening the moderation GUI — nothing more.
daisyfilter.test	op	test.
daisyfilter.inspect	op	violations, inspect, player, history, audit, filters, allowlist.
daisyfilter.notes	op	Staff notes and the watchlist (note, notes, watch, unwatch, watchlist).
daisyfilter.export	op	export (metadata).
daisyfilter.monitor	op	monitor toggle.
daisyfilter.alerts	op	Receiving and toggling staff alerts.
daisyfilter.view.raw	false	Decrypting and exporting raw content. Not granted to operators by default.
daisyfilter.appeal	true	Using /appeal to contest an active mute (granted to everyone).
daisyfilter.punish.warn	op	Dispatching configured warning profiles.
daisyfilter.punish.mute	op	Dispatching configured mute profiles.
daisyfilter.punish.kick	op	Dispatching configured kick profiles.
daisyfilter.punish.ban	false	Dispatching configured ban profiles.
daisyfilter.punish.custom	false	Dispatching custom profiles that use this permission.

GUI actions

daisyfilter.gui grants only the right to open the menus. Every action inside them is gated on the same node its command equivalent needs, checked when the button is drawn and again when it is clicked, so a staff member never sees a control they cannot use.

GUI action	Required
Recent Violations, incident detail, Staff Audit Log, player profile & history	daisyfilter.inspect
Mark Reviewed, Pardon	daisyfilter.inspect
Active Mutes panel, lifting a mute (with confirmation)	daisyfilter.punish.mute
Adding a staff note, adding/removing from the watchlist	daisyfilter.notes
Exact evidence on an incident	daisyfilter.view.raw
Punish Player	the profile’s own permission in actions.yml
Add Allowlist Exception, Disable Matched Rule	daisyfilter.admin
Integrations (webhook and Discord bot settings)	daisyfilter.admin

This means you can safely hand a trainee moderator daisyfilter.gui plus daisyfilter.inspect to let them read and review incidents without also giving them the ability to allowlist terms or switch rules off.

daisyfilter.gui also covers /daisyfilter link and unlink, which bind a Discord account to a Minecraft one. Linking confers no authority by itself — what a linked user may actually do in Discord comes from the roles map in discord.yml, and nothing else. See discord.md.

Bypass

All bypass permissions default to false, including for operators, so filtering is never silently skipped by accident.

A bypass exempts a person, not a word — it skips scanning entirely on that surface, so nothing is logged and nothing is alerted. Never grant one to a default rank on a server with children. If what you actually want is to permit a word or switch off one misfiring rule, see which whitelisting route you need.

Permission	Skips filtering on
daisyfilter.bypass	every surface and spam
daisyfilter.bypass.chat	chat
daisyfilter.bypass.commands	communication commands
daisyfilter.bypass.signs	signs
daisyfilter.bypass.books	books
daisyfilter.bypass.anvil	anvil renames
daisyfilter.bypass.nickname	nickname changes
daisyfilter.bypass.player-name	nicknames and entity name tags — not the username check at login
daisyfilter.bypass.custom	custom API surfaces
daisyfilter.bypass.spam	spam/abuse heuristics

Bypass is evaluated from a thread-safe snapshot refreshed on join and in batches, so chat-thread checks never touch the permission system directly. A LuckPerms refresh hook is added only when LuckPerms is installed.

That snapshot is only held while a player is online, which is why daisyfilter.bypass.player-name cannot exempt the username check at login — there is no player yet to read permissions from. It exempts nicknames and entity name tags only.

Testing with a wildcard (*) permission

If you grant yourself * in LuckPerms you also receive every daisyfilter.bypass.* node, so filtering is skipped for you. To keep * but still be filtered while testing, negate both the global node and the wildcard:

/lp user <you> permission set daisyfilter.bypass false
/lp user <you> permission set daisyfilter.bypass.* false

daisyfilter.bypass.* covers the per-surface and spam children; daisyfilter.bypass is a separate node and must be negated on its own.