Role-Based Access Control (RBAC)

# Overview

Security inside an administrative dashboard is as critical as catching exploiters. If an unauthorized player could invoke admin remotes to kick other players or wipe ban records, the security of the game would be broken.

RAC implements Role-Based Access Control via ServerScriptService/RAC/Security/PermissionManager.luau. Every incoming action over AdminRemote is validated against the player's server-verified Roblox UserId.

---

# Role Assignment in config.luau

Administrators are mapped directly by UserID:

Config.Admin = {
    Roles = {
        [727289569] = "Owner",      -- Full system control & unbanning
        [12345678] = "SuperAdmin", -- Server tuning & permanent bans
        [23456789] = "Admin",      -- Kicks, temp bans, config inspection
        [34567890] = "Moderator",  -- Warnings, spectating, freeze
    },
    
    DefaultRole = "Viewer",         -- Unlisted players have read-only or no access
}

[!TIP] During Roblox Studio test runs, PermissionManager automatically grants the local developer the Owner role (RunService:IsStudio() == true), enabling instant testing without manual ID configuration.

---

# Permission Gate Checks

Before executing any administrative action, the server verifies that the caller's role level satisfies the requirement:

function AdminServer:HandleKickRequest(moderator: Player, targetUserId: number, reason: string)
    -- Verify moderator has permission to kick
    if not PermissionManager.CanExecute(moderator, "KICK_PLAYER") then
        warn(string.format("[Security Alert] Unauthorized kick attempt by %s", moderator.Name))
        return false, "Insufficient permissions"
    end

    -- Execute kick
    return PunishmentManager.KickPlayer(targetUserId, reason)
end

---

# Next Steps

• Explore the complete permissions matrix in Roles & Levels Reference.
• Learn about Discord Webhooks.