Kubestro » Server

The platform needs a single, discoverable list of everything that can be authorised, so that an administrator building a role picks from real capabilities with readable descriptions instead of typing identifiers, and so that a newly installed module can add its own capabilities without the platform being changed for it.

A permission is named as namespace.resource.action, for example core.user.create or minecraft.server.restart, and carries a human description plus the kinds of object it can be applied to. The platform's own permissions exist on a fresh install; a module contributes the permissions of its namespace when it connects. Removing a module takes its permissions, and the access granted through them, away again.