Skip to content
Blog

FiveM ACE permissions: give staff only the commands they need

How add_ace and add_principal work in server.cfg, a moderator and admin setup to copy, checks in scripts, and where ACE stops being enough for staff.

By Termi

4 min read
  • Staff
  • Permissions
  • server.cfg
  • Security
On this page

Every FiveM server runs into the same question: how do you let a moderator kick people without letting them hand out money or shut the server down? FXServer answers it with ACE, the permission system you configure in server.cfg. This guide covers how ACE works, a staff setup you can copy, how scripts check permissions and where it stops being enough.

How ACE works

ACE has two kinds of lines. add_ace grants a permission to a principal, and add_principal makes one principal inherit from another. Players are principals named after their identifiers, and groups are principals you name yourself:

server.cfg
add_ace group.admin command allow
add_ace group.admin command.quit deny
add_ace group.mod command.kick allow
add_ace group.mod command.warn allow

add_principal group.admin group.mod

add_principal identifier.license:9a4f00ab12cd34ef group.admin
add_principal identifier.discord:123456789012345678 group.mod
  • command on its own covers every command, so group.admin can run all of them.
  • command.quit deny takes one of those away again. A deny beats an allow for the same permission, and the default server.cfg uses this exact line to stop admins from running quit.
  • command.kick covers the command called kick and nothing else.
  • add_principal group.admin group.mod makes admins inherit everything mods have.
  • Players join a group through an identifier: license, discord, steam or fivem. Use the license where you can, because it stays with the Rockstar account.

The same lines typed into the server console apply at once, so you don’t need a restart to give someone a role. Put them in server.cfg as well, or they are gone after the next restart.

Check permissions in a script

A command registered as restricted only runs for principals that have command.<name>. The true at the end is the restriction:

server.lua
RegisterCommand('revive', function(source, args)
    local target = tonumber(args[1]) or source
    TriggerClientEvent('hospital:revive', target)
end, true)

For anything that isn’t a command, such as a menu button or a net event, check the permission yourself on the server, and grant it like any other ACE:

server.lua
RegisterNetEvent('admin:giveMoney', function(target, amount)
    if not IsPlayerAceAllowed(source, 'admin.money') then return end
    local player = QBCore.Functions.GetPlayer(target)
    if player then player.Functions.AddMoney('bank', amount, 'admin') end
end)
server.cfg
add_ace group.admin admin.money allow

Check on the server

Never rely on a permission check in a client script. Players can trigger any net event with arguments of their choosing, so the check has to sit in the server handler.

ESX, QBCore and txAdmin

QBCore uses ACE as well: its permission levels are principals called qbcore.god, qbcore.admin and qbcore.mod, which you hand out with add_principal. ESX keeps its own group column in users and checks it with xPlayer.getGroup(). txAdmin has a third set, admin accounts with their own permissions for its panel and in-game menu, such as kicking, banning or restarting, and those apply inside txAdmin only.

Where ACE stops being enough

  • It lives in server.cfg. Changing a moderator’s rights means editing a file and running the line again in the console.
  • ACE itself keeps no record of who ran what, so after the fact nothing ties a command to a person.
  • It can only allow or deny. A command that hands out a million dollars runs the moment someone with the permission types it, and there is no way to make it wait for a second person.

Roles and approvals in FiveDock

FiveDock’s panel runs server commands through the agent, so staff can act from a phone without joining the game. Each staff member signs in with their own account, through a passkey, Discord or an emailed link, and every action goes into the activity log with their name on it, on every plan.

On Metro, roles decide who can run each command: support gets kick and warn, owners get everything. With a second owner, dangerous commands wait for that owner’s approval before they run. On Free and City, commands that give money or items can already wait for a second staff member’s OK.

Metro also masks personal data by role, so trainees never see real addresses or payment details, and its database viewer lets admins look at a table while the database password stays on the server.

Common questions

How do I give someone admin on my FiveM server?

Add a line to server.cfg that puts their identifier in the admin group, such as add_principal identifier.license:<their license> group.admin, and make sure group.admin has the permissions you want, for example add_ace group.admin command allow. Type the same lines into the server console to apply them without a restart.

Where do I find a player’s license identifier?

txAdmin’s player page lists every identifier, and so does the GetPlayerIdentifiers(source) native. The license is the one that starts with license:.

What is the difference between add_ace and add_principal?

add_ace gives a principal a permission. add_principal makes one principal a member of another, so it inherits that principal’s permissions. You give permissions to groups with add_ace and put players in groups with add_principal.

Why does my restricted command say access denied?

The player’s identifier isn’t in a group that has command.<name>, or the line uses a different identifier from the one they connect with. Check the identifier type and value, and remember that a deny overrides an allow.

Related docs

More from the blog

All articles