Least privilege on a Discord server means giving each role only the permissions its job needs — a support role that can manage tickets does not also need Ban Members, and a bot that grants a verification role does not need to sit above every role in the server, only the one it grants. Most servers get this wrong in one of two ways: everyone with any responsibility gets Administrator because it is easier, or nobody gets anything and the owner becomes a bottleneck. Here is how the admin role, staff roles, bot role placement and trusted-account lists fit together, using the settings Noxyr actually exposes.
Two different questions: "who can configure the bot" and "who can run admin commands in Discord"
These are not the same thing, and mixing them up is the most common confusion. Opening the web dashboard for a server requires being that server's owner or holding the Administrator permission in it — checked live against Discord every time you load the page, not against a cached list. Running admin slash commands in Discord itself is a separate, configurable list: the admin access roles you pick on the dashboard's Setup page. A person can be in an admin role that runs /security in Discord without ever being able to open the dashboard, and vice versa.
- Admin access roles (Setup page): who can run the bot's admin slash commands, once Discord finishes registering the refreshed command permissions.
- Reserved staff roles (Setup page): saved for support workflows — ticket routing and similar — and do not by themselves grant admin command access.
- Dashboard access: server owner or anyone with the Administrator Discord permission. Admin roles configured inside the bot do not open the dashboard on their own.
Why "just give it Administrator" is the wrong default for staff, right default for the bot
For a human staff role, Administrator is almost always overkill: a moderator handling tickets does not need to delete channels, and giving them that ability only widens what a phished or careless account can do. Build staff roles around what they actually do — ticket access, review moderation, catalog editing — and reserve full Administrator for people you would trust with the entire server if their account were compromised tomorrow.
The bot itself is the one place Administrator makes practical sense: Noxyr needs to create ticket channels, manage roles during verification, act on anti-nuke triggers and post in any channel a feature is configured for, and Administrator is the simplest way to guarantee none of that silently fails on a channel with unusual permission overrides. If you would rather grant specific permissions instead, the Discord permissions reference lists exactly what each one covers — at minimum the bot needs Manage Roles, Manage Channels, Manage Messages, Kick Members, Ban Members, Moderate Members and View Audit Log for its security and moderation features to work at all.
Role hierarchy: the mistake that breaks verification and anti-nuke silently
Discord will not let any bot — including this one — grant or remove a role positioned above the bot's own highest role, or act on a member whose highest role sits above the bot's. This shows up in two places specifically:
- Verification: if the verify role sits above the bot's role in the server's role list, clicking Verify does nothing and Discord silently refuses the grant. Move the bot's role above the verify role.
- Anti-nuke and moderation: the bot cannot time out, kick or ban an account whose highest role outranks its own — which matters most for a compromised co-owner account, exactly the scenario anti-nuke exists for. Keep the bot's role high enough to act on the accounts you actually need it to.
A quick check after any role reshuffle: open Server Settings → Roles and confirm the bot's role is still above anything it needs to grant or act on. This is the single most common "why isn't the bot doing anything" ticket, and it never shows an error in Discord — the action just silently fails.
Trusted roles and users: the deliberate exception to anti-nuke
Anti-nuke times out, kicks or bans any account that crosses your configured action limit, with one exception list per server: trusted roles and trusted user IDs, set on the Security page. Add a co-owner who legitimately deletes and recreates channels in bulk, or a helper bot with elevated permissions. The honest tradeoff: every trusted entry is an account whose compromise anti-nuke cannot stop, so the list should only ever contain people you would hand the server to outright. See the anti-nuke guide for how the detection itself works.
A sane role layout for most servers
- Owner: never actioned by anti-nuke, always has dashboard access. Keep this to one real person's account, with 2FA on.
- Co-owner / senior admin: Administrator in Discord, added to the bot's admin access roles, added to anti-nuke's trusted list only if they do bulk channel or role work regularly.
- Moderator / staff: a role scoped to Kick Members, Manage Messages and Moderate Members — not Administrator — added to reserved staff roles for ticket routing, and to admin access roles only if they should run
/security,/moduleor similar. - Verified member: the role your verification panel grants, positioned below the bot's own role.
Common questions
Does removing someone's Administrator permission in Discord also remove their dashboard access? Yes, immediately — the dashboard checks live against the server every time, so a permission pulled in Discord takes effect on the next dashboard page load.
My admin role can't run the bot's slash commands. Why? Discord takes a short time to register refreshed command permissions after you change the admin roles list. If it still fails after a few minutes, double-check the role was actually saved on the Setup page.
Can I have more than one admin role or staff role? Yes, both are multi-select — pick as many roles as fit your structure.
Should I trust a role or a specific user in anti-nuke? Trust roles for a small, stable group (co-owners); trust individual user IDs for a one-off exception like a specific bot account, so you are not accidentally trusting everyone who is ever promoted into a role later.
What's the single biggest permission mistake servers make? Giving every staff member Administrator "to be safe." It is the opposite of safe — it means a single phished mod account can do anything the owner can, including everything a server nuke covers.
Set admin and staff roles on the Setup page of your server dashboard, and review your security settings once the role layout is right — thresholds only protect a server whose role hierarchy is actually sound underneath them.