FiveM ACE permissions and principals

ACE is FiveM's built-in permission system. It decides who can use admin commands, who can restart resources, and who can ban players. It works the same on every server - vanilla, ESX, QBCore, Qbox - because it's part of FiveM itself, not any framework.

You'll build: A permission system using ACE and principals - give admins, moderators, and trusted players exactly the powers they need and nothing more.
Time: ~20 minutes
You need: A FiveM server with server.cfg access. No resources or frameworks required - ACE is built into FiveM itself.
You'll learn: What ACE permissions are, how principals connect players to groups, how allow and deny work together, wildcard permissions, and how to build a clean staff permission system.

BEFORE YOU START

Build it

Understand the three parts

You can explain each piece of the permission system.

Every ACE line has three parts:

code

add_ace <principal> <permission> <allow|deny>

Principal - who. A group (group.admin), an individual (identifier.license:abc123), or everyone (builtin.everyone)
Permission - what. command.kick, command.ban, resource.myresource, or custom like i.am.cool
Allow/Deny - whether they can or can't

Groups are the most common principal. Instead of giving permissions to 10 different admins one by one, you give them to group.admin once, then add each admin to that group.

Add a player to a group (principals)

Your player is in the admin group.

A principal connects a player to a group:

code

add_principal identifier.license:abc123def456 group.admin

The identifier format is identifier.<type>:<value>. Common types:

license - tied to your Cfx.re account (most stable, use this)
steam - tied to your Steam account
fivem - old format, still works but license is preferred

Find yours in txAdmin → Players → click your name → Identifiers.

Groups can also inherit from each other. Admins should get moderator powers automatically:

code

add_principal group.admin group.moderator

Now group.admin inherits everything group.moderator can do. Admins automatically get moderator permissions - you don't need to grant them twice.

Give permissions to a group (ACEs)

Admins can kick and ban, moderators can only kick.

ACE lines grant or deny specific permissions:

code

# Admin gets everything
add_ace group.admin command.kick allow
add_ace group.admin command.ban allow
add_ace group.admin command.restart allow

# Moderator gets kick only - not ban
add_ace group.moderator command.kick allow
add_ace group.moderator command.ban deny

By default, everything is denied. You only get what you explicitly allow.

Note on built-in commands: a command.X ace only gates X if a resource registered that command through the ACE system. Not all built-in server/console commands have a default ACE object; many, like restart, are console/txAdmin commands, so an ace for them may control nothing on its own.

Deny is stronger than allow. If a player is in two groups and one denies command.ban, they cannot ban - even if another group allows it. Deny always wins.

Use wildcards for bulk permissions

One line can grant multiple permissions.

Wildcards give access to everything under a category:

code

# Give admins ALL commands
add_ace group.admin command allow

command without a dot means "all command.* permissions." This grants command.kick, command.ban, command.restart, and every other command permission.

Be careful with this. Only give broad wildcards to owners. For staff, grant specific permissions one by one.

Other useful wildcards:

code

# Give a resource full access
add_ace resource.my_admin_menu command allow

# Block everything from a dangerous resource
add_ace resource.suspicious_script command deny

Keep reading the full lesson

Still ahead in this lesson

The complete starter template
Useful commands
Common failures
⚠ Safety rules