Manage Oxide plugin permissions without granting everyone admin

Oxide permissions decide which plugin features a player may use. Rust owner status, a chat prefix and a plugin permission are different things. Diagnose the named feature before changing access for the entire server.

Prepare a permission record

Confirm the plugin loaded successfully and find the exact permission names in its current author documentation. A permission cannot be granted usefully if the plugin never registered it. Record the plugin version, the user's Steam64 ID and current groups. Back up Oxide configuration, permission data and any affected plugin data before restructuring roles.

Use the trusted server console for these commands. Replace uppercase placeholders with real values; the examples are command forms, not accounts that already exist on your server. Prefer a full Steam64 ID over an ambiguous display name.

Inspect before granting

oxide.show user STEAM64
oxide.show perm PLUGIN.PERMISSION

Look for both direct grants and inherited access. Membership of multiple groups can explain why revoking one direct permission makes no visible difference. Do not remove existing groups until you understand what other features they provide.

Apply a narrow change

For a single-person trial, grant the specific permission directly:

oxide.grant user STEAM64 PLUGIN.PERMISSION

If the same role is needed for several people, create a deliberately named group with the supported Oxide group command, then grant the documented permission and add the test member:

oxide.group add helpers
oxide.grant group helpers PLUGIN.PERMISSION
oxide.usergroup add STEAM64 helpers

Do not substitute a wildcard permission. The default group includes ordinary players, so granting it a permission changes the experience for the whole community. Administrator groups should not become a convenient container for cosmetic or paid features.

Test the ordinary-player experience

Have the test account reconnect if the plugin requires it, then try only the intended feature.
Check for the expected success message and any corresponding plugin error.
Verify that an unrelated player still cannot use the feature.
Check that the new role has not unexpectedly unlocked inventory access, teleport administration or other privileged actions.

Testing solely with a server owner can hide a missing permission or bypass a normal restriction. Where possible, use a separate ordinary account for the acceptance check.

Revoke precisely and preserve evidence

oxide.revoke user STEAM64 PLUGIN.PERMISSION
oxide.revoke group helpers PLUGIN.PERMISSION
oxide.usergroup remove STEAM64 helpers

Run only the rollback commands matching the change you actually made. Removing a group membership can affect multiple permissions at once. Record the before-and-after output privately so you can explain the result without resetting the complete permission database.

If the permission is reported as unknown, inspect plugin loading and spelling first. If it exists but behaviour is unchanged, check inherited groups, plugin-specific restrictions and the author documentation. Send redacted results to support rather than granting global access as a workaround.