Managing Permissions with the ACE System
A practical guide to FiveM's ACE permission system for granting admin rights, restricting commands, and managing player groups.
Overview
FiveM uses the Access Control Entries (ACE) system to control which players and groups can execute commands or trigger protected actions. ACE is configured entirely in server.cfg (or an included config file) using add_ace and add_principal directives. It replaces older add_admin approaches and is the only permission mechanism built into the base game.
Core Concepts
| Term | Meaning |
|---|---|
| Principal | An identity — a player, group, or built-in entity |
| ACE | A rule that grants or denies a principal access to an object |
| Group | A named collection of principals |
builtin.everyone |
Special principal that applies to every connected player |
Granting Permissions to a Group
Use add_ace to allow a group to perform an action:
add_ace group.admin command.kick allow
add_ace group.admin command.ban allow
add_ace group.admin command.tempban allow
The format is:
add_ace <principal> <object> <allow|deny>
command.kick refers to the built-in kick command. Resources can define their own ACE-gated objects using IsPlayerAceAllowed() in Lua.
Adding a Player to a Group
Identify the player by one of their identifiers, then use add_principal:
add_principal identifier.steam:11000010b6e7e2e group.admin
The format is:
add_principal identifier.<type>:<value> group.<groupname>
Supported Identifier Types
| Type | Format | Example |
|---|---|---|
| Steam | steam:HEXID |
steam:11000010b6e7e2e |
| License (Rockstar) | license:HEXID |
license:a3f... |
| Discord | discord:SNOWFLAKE |
discord:123456789012345678 |
| IP address | ip:ADDRESS |
ip:203.0.113.42 |
Finding a Player's Steam Hex ID
Convert their SteamID64 to hexadecimal. For example, SteamID64 76561198012345678 converts to hex 11000010b6e7e2e.
Tools to do this conversion are widely available online, or use Lua in a server script:
local steamId = GetPlayerIdentifierByType(source, 'steam')
-- steamId will be in the format "steam:11000010b6e7e2e"
Alternatively, read identifiers from the txAdmin Player Manager panel — it lists all identifier types for connected players.
Restricting a Command from Everyone
To prevent all players from using a command:
add_ace builtin.everyone command.noclip deny
Then explicitly allow it for admins:
add_ace group.admin command.noclip allow
deny takes precedence over allow when both apply to the same principal hierarchy.
Nested Groups
Groups can inherit from other groups. To make superadmin inherit all admin permissions:
add_principal group.superadmin group.admin
Now any player in group.superadmin also has all group.admin ACEs.
Checking Permissions in a Resource
From a server-side Lua script:
if IsPlayerAceAllowed(source, 'my_resource.action') then
-- execute the privileged action
end
Grant the ACE in server.cfg:
add_ace group.admin my_resource.action allow
Complete Example Configuration
# --- ACE Permissions ---
add_ace group.admin command.kick allow
add_ace group.admin command.ban allow
add_ace group.admin command.tempban allow
add_ace group.admin command.unban allow
add_ace group.admin command.restart allow
# --- Admins ---
add_principal identifier.steam:11000010b6e7e2e group.admin
add_principal identifier.steam:11000010aaaaaaa group.admin
Keep this section near the top of server.cfg or in a dedicated included file, updated whenever admin rosters change.