Permissions & access

ClashDuke gives you three layers of access control, from simplest to most granular:

Manager role

One role that unlocks manager-gated commands.

Command delegation

Grant individual commands to specific roles or members with /access.

Web dashboard roles

Fine-grained, permission-based roles for the web control panel.

1. The manager role

By default, management commands require Discord’s Manage Server permission. To let trusted staff manage ClashDuke without that permission, set a manager role:

/config manager_role:@Co-Leaders

Anyone with the Manage Server permission is always treated as a manager; the manager role simply adds more people to that group.

2. Per-command delegation — /access

/access delegates a single command to specific roles or members. Granting a command has two effects at once:

1. It allows the target role/member to run that command, and
2. It restricts that command to those delegated roles/members plus Manage-Server managers.

In other words, delegating a command also locks it down.

!

Once you grant a command to anyone, it is limited to the delegated roles/members and Manage-Server managers. Members who could previously use it (via a manager role, for example) will need an explicit grant.

/access itself requires Manage Server.

Subcommand	Options	Description
/access grant	command (autocomplete, required), target (role or member, required)	Allow a role or member to use a command
/access revoke	command (autocomplete, required), target (role or member, required)	Remove a delegation
/access list	—	Show all command delegations

/access grant command:/war target:@War Team

i

Without any delegation, each command uses its own built-in permission gate (for example, most /setup subcommands require Manage Server). /access is only needed when you want to hand a specific command to people who wouldn’t otherwise have it.

3. Web dashboard roles (RBAC)

The web dashboard uses its own role-based access control, resolved live on every request so changes and revocations take effect immediately. Each web role is a named bundle of permission keys, and roles have a rank — you can only assign roles ranked below your own.

Built-in role presets

ClashDuke ships a set of cloneable role presets you can assign or customize per server:

Role	What it’s for
Owner	Full control, including billing
Admin	Everything except billing
Co-Leader	Wars, rosters, reminders, war room, CWL, moderation, clans, exports
War Manager	Wars, rosters, reminders, war room, CWL
Family Ops Lead	Family announcements, stats, end-of-day, signups, pre-spin, DM rules, exports
Elder / Staff	Tickets, moderation, player views
Recruiter	Tickets, links, player views
Analyst	History, leaderboards, exports, player & family views
Event Manager	Rosters, signups, embeds, announcements
Moderator	Moderation, tickets, audit log
Editor	Embeds, log feeds, boards
Treasurer	View billing
Viewer	Read-only across the dashboard
Member	Dashboard access only (the default for a self-serve Discord login)

Permission keys

Roles are built from granular permission keys, grouped by area — for example wars.view, rosters.manage, reminders.manage, moderation.manage, logs.manage, autoroles.manage, billing.manage, and settings.manage. Web guards and the bot resolve access against this same vocabulary, so the dashboard and the bot stay consistent.

i

A new member who logs into the dashboard with Discord starts on the Member role (dashboard access only). Promote them by assigning a higher role from the dashboard’s member management.

How the layers work together

• Bot commands are gated by Discord permissions (Manage Server), the manager role, and any /access delegations.
• The dashboard is gated by the web RBAC roles above.
• Superadmin access (the platform operator) is always explicit — never implied by a server role.

*

For a light setup, a single manager role covers most teams. Reach for /access when you want to hand one specific command to a group, and use dashboard roles when you’re delegating web access to co-leaders and staff.