Give staff the least access they need

Hand every helper the smallest set of permissions that lets them do their actual job, keep panel access and in-game rank separate, and take access back the day someone stops helping.

6 min read · Updated Oct 21, 2026 · By GuavaHost Team

The idea in one line

Least privilege means a person gets the access their role requires and nothing more. It is not about distrust. It is about shrinking the blast radius: when a helper's account is phished, or when someone clicks the wrong button at 2am, the damage is limited to what that account could reach.

Most server disasters are not attacks. They are a trusted person with more access than their job needed, having a bad day.

Two different kinds of power

The first thing to separate in your head: panel access and in-game rank are not the same thing, and most of your staff only need one of them.

A moderator who handles chat and rule breakers needs a rank, not a login to your panel. Give them the rank, point them at your moderation tools, and stop there. For Minecraft that is usually a role in a permissions plugin, set up as in Set up LuckPerms permissions, with the day-to-day commands covered in Minecraft staff and moderation tools.

Operator status is the exception that catches people out. In Minecraft, op grants essentially everything, including commands that can wreck a world, so handing out op instead of a rank is the opposite of least privilege. Op yourself and the admin commands explains what op really covers, and a permissions plugin is how you give a moderator the three commands they actually need.

When someone does need the panel

Give it to them as a sub-user, never by sharing your password. A sub-user signs in with their own GuavaHost account, sees only the server you shared, gets only the permissions you chose, and never sees your invoices or your plan. The full walkthrough is in Giving a friend access with sub-users.

The invite offers ready-made sets plus Choose exactly, where permissions are grouped as Console & power, Files, Backups, People, Ports & network, Scheduled tasks, Databases, Startup settings, Server settings and Activity.

Here is how that maps to real roles:

• A moderator who needs to restart a stuck server. The Can play and restart set. Console and power only. No files, no backups, no settings.
• A builder or a plugin helper. Can manage files. They can edit configs and upload jars, and connect over SFTP with their own SFTP login, but cannot delete backups or touch the plan.
• A co-owner you genuinely trust with the whole thing. Full access except billing, or better, Choose exactly with the reinstall permission left out.
• Someone doing one specific job once. Pick exactly the group they need, and remove it when the job is done.

Start narrower than feels polite. Adding a permission later takes ten seconds. Undoing a deletion takes a restore.

The actions worth withholding

Some permissions do things that cannot be walked back, or that reach beyond the server. Keep these to yourself unless there is a concrete reason:

• Reinstalling the server. One confirmation and the server is rebuilt from scratch. See Reinstalling your server for what that actually removes. Almost nobody needs this.
• Deleting backups. Someone who can delete your backups can remove your recovery option before you know you need it. Let helpers create backups by all means; think twice about delete.
• Startup settings. This is where the version, the jar and the memory flags live. A wrong value here is a server that will not boot, and the cause is not obvious from the console.
• People. A sub-user with People can invite more sub-users, which quietly makes your access list somebody else's decision.
• Databases. Database credentials sit in plain text in plugin configs, and a database holds player data. Hand this out only to whoever maintains those plugins.
• Anything billing. Sub-users never get billing, plan changes or cancellation, which is exactly right. That is a reason to use sub-users rather than sharing your login.

Also: everyone with panel access should have two-step login on their own GuavaHost account. Your careful permission set does not help if a helper's account is taken over.

Make changes reviewable

Least privilege works best alongside a record of who did what.

• The Activity page, under More in your server's menu, logs panel actions: who started or stopped the server, who changed a file, who restored a backup. The panel activity log covers reading it.
• The Console tab logs joins, leaves and every command typed, so in-game actions have a trail too.
• For block-level history on Minecraft, a logging plugin is the real answer, and Roll back griefing with CoreProtect shows how to see exactly who placed or broke what, and undo just their edits.
• Take a backup before you hand anyone new access to files. The Backups page, covered in Backups, is the undo button for everything else in this guide.

Tell your staff the log exists. It is not surveillance, it is how a mistake gets found and fixed in five minutes instead of being argued about.

Review access on a schedule

Access accumulates. Someone gets files access for one weekend of plugin work and still has it a year later, on an account they stopped using. Put a recurring note in your calendar, once a quarter, and do this:

1. Open People on your server. Anyone you cannot immediately name a reason for comes off.
2. For everyone who stays, click Edit and trim whatever they no longer need.
3. Check your in-game ranks the same way, and the op list if you have one.

Removing access when someone leaves

Do this the same day, not next week, and do it in full even when the parting was friendly:

1. Remove them from People. That ends their panel access immediately and does not affect their own GuavaHost account.
2. Take their in-game rank down, and deop them if they were op.
3. Change the SFTP password on the server's Settings tab if they ever had file access. The SFTP login is separate from the panel, so removing the sub-user does not rotate it.
4. Rotate shared secrets they could have read. Database passwords, Discord bot tokens, store API keys: if they had files or databases access, those were readable in configs.
5. Take a fresh backup so you have a clean reference point from after the handover.

If something has already gone wrong, What to do if your server was griefed or hacked is the order to work in, and Keeping griefers out covers the prevention side.

Common questions

Should my moderators have panel access at all?

Usually not. Moderating is kicks, bans, mutes and chat, all of which happen in-game through a rank. Give panel access only to the one or two people who genuinely restart the server or install things.

What is the difference between a sub-user and an in-game admin?

A sub-user is a login to your control panel, so it controls the server as a machine: files, backups, power, settings. An in-game admin is a rank inside the game that controls what commands a player can run. Someone can easily need one and not the other.

Does removing a sub-user delete their GuavaHost account?

No. It only removes their access to your server. Their own account carries on untouched, and you can invite them again later with whatever permissions you choose then.

My co-owner pays half the bill. Should they get billing access?

Sub-users never see billing, by design, so there is no permission to hand over. If you both need to manage the service itself, the cleaner answer is to decide whose account holds it and use a sub-user for the other, rather than sharing one login between two people.

Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.

• staff
• permissions
• sub-users
• access
• security

Still need help? Our team is online 24/7 to answer questions.

Contact support