> ## Documentation Index
> Fetch the complete documentation index at: https://docs.razebot.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Restrictions

> Control who can run a custom command with allow lists, deny lists, and required permissions.

# Restrictions

> Control who can run a custom command with allow lists, deny lists, and required permissions.

## Evaluation order

```mermaid theme={null} theme={null}
graph TD
    A[Command invoked] --> B{On the deny list?}
    B -- Yes --> C[Blocked]
    B -- No --> D{Any allow entries exist?}
    D -- Yes --> E{Matched an allow entry?}
    E -- No --> C
    E -- Yes --> F{Holds every required permission?}
    D -- No --> F
    F -- No --> C
    F -- Yes --> G{Script contains actions?}
    G -- No --> H[Runs]
    G -- Yes --> I{User or role allow match?}
    I -- Yes --> H
    I -- No --> J{Holds the action permission?}
    J -- Yes --> H
    J -- No --> C
```

<Steps>
  <Step title="Deny list always wins">
    If the invoker, one of their roles, or the current channel is denied, the command stops immediately — no matter what else is configured.
  </Step>

  <Step title="Allow list gates entry">
    If **any** allow entry exists, the invoker must match one of them (as a user, through a role, or by running it in an allowed channel). If no allow entries exist at all, everyone passes this step.
  </Step>

  <Step title="Required permissions are always checked">
    Whatever `;cc requireperm` lists must be held by the invoker. Matching an allow entry does **not** skip this.
  </Step>

  <Step title="Action permissions are checked last">
    If the script runs [actions](/server-config/custom-commands/actions), the invoker needs the mapped permission — unless a **user or role** allow entry covers them, which bypasses this step only.
  </Step>
</Steps>

<Info>
  A channel allow entry lets the command run in that channel. It never bypasses a permission check — only user and role entries do that, and only for action permissions.
</Info>

***

## Commands

All of these require **Manage Server**.

<Tabs>
  <Tab title="Allow">
    ```bash theme={null} theme={null}
    ;cc allow (name) (@user | @role | #channel)
    ;cc unallow (name) (@user | @role | #channel)
    ```

    ```bash theme={null} theme={null}
    ;cc allow greet @Staff
    ;cc allow greet #bot-commands
    ;cc unallow greet @Staff
    ```
  </Tab>

  <Tab title="Deny">
    ```bash theme={null} theme={null}
    ;cc deny (name) (@user | @role | #channel)
    ;cc undeny (name) (@user | @role | #channel)
    ```

    ```bash theme={null} theme={null}
    ;cc deny greet @Muted
    ;cc deny greet #general
    ```
  </Tab>

  <Tab title="Required permissions">
    ```bash theme={null} theme={null}
    ;cc requireperm (name) (permission) [permission...]
    ;cc requireperm (name) clear
    ```

    Permission names are accepted in any casing — `ManageMessages`, `manage_messages`, and `Manage Messages` all work. An unrecognised name is rejected.

    ```bash theme={null} theme={null}
    ;cc requireperm cleanup ManageMessages
    ;cc requireperm cleanup ManageMessages BanMembers
    ;cc requireperm cleanup clear
    ```
  </Tab>

  <Tab title="Review / reset">
    ```bash theme={null} theme={null}
    ;cc restrictions (name)
    ;cc restrictions (name) clear
    ```

    Shows allowed and denied users, roles, and channels plus the required permissions. `clear` wipes all of it in one go.
  </Tab>
</Tabs>

***

## Worked example

Goal: a `;quiet` command that times someone out for 10 minutes, usable only by moderators, only in the staff channel, and never by a suspended moderator.

<Steps>
  <Step title="Create it">
    ```bash theme={null} theme={null}
    ;cc set quiet (target) -- {mod:timeout {target} && 10m && Told to cool off}Timed out {punishment.user.mention} for 10 minutes.
    ```

    You must hold **Moderate Members** yourself to save this, because of the `{mod:timeout}` action.
  </Step>

  <Step title="Limit it to the staff channel and the mod role">
    ```bash theme={null} theme={null}
    ;cc allow quiet @Moderator
    ;cc allow quiet #staff-commands
    ```

    Only members with @Moderator get through, and only inside #staff-commands. Because @Moderator is a **role** allow entry, those members no longer need Moderate Members for the action itself.
  </Step>

  <Step title="Require a Discord permission on top">
    ```bash theme={null} theme={null}
    ;cc requireperm quiet ModerateMembers
    ```

    This check is never bypassed by an allow entry, so an allowed moderator who lost the permission is still refused.
  </Step>

  <Step title="Suspend one person without touching the rest">
    ```bash theme={null} theme={null}
    ;cc deny quiet @wanderer
    ```

    The deny entry beats their @Moderator allow entry.
  </Step>

  <Step title="Confirm the result">
    ```bash theme={null} theme={null}
    ;cc restrictions quiet
    ```
  </Step>
</Steps>