Server security · Checked October 12, 2026

Roles, permissions and the 2FA requirement

How Discord’s role hierarchy works, which permissions are dangerous, and why every staff account should need 2FA.

Open in Kipp’s docs

1. 1. Know the hierarchy

   Members can only act on people whose highest role is below their own. Even with Ban or Kick, nobody can ban, kick or rename someone with an equal or higher role, and with Manage Roles you can only change roles below your highest role. Bots follow the same rule, which is why a security bot’s role must sit above the roles it protects against.

   Kipp guide

2. 2. Treat Administrator as a last resort

   Administrator grants every permission and bypasses every channel override. Discord asks you to give it with extreme caution, to users or bots, only as needed. A role with the specific permissions someone needs is safer, because channel permissions still apply to it.

3. 3. Know the other dangerous permissions

   Manage Server (server settings, invites and adding bots), Manage Roles, Manage Channels, Manage Webhooks (every webhook and integration), Ban and Kick Members, and Mention @everyone, @here and All Roles. Give these to as few people as possible, and turn off mass mentions for roles you don’t fully trust.

4. 4. Keep @everyone harmless

   @everyone is the template for every role (its id is the same as your server’s id). If @everyone has a dangerous permission, every member has it. Check it after adding any bot or template.

   Dashboard: Overview

5. 5. Understand channel overrides

   Discord applies permissions in this order: @everyone, then roles, then channel denies and allows for @everyone, then for roles, then for the member. When two roles disagree in a channel, Discord allows. Use as few overrides as you can so you can still reason about who sees what.

6. 6. Require 2FA for moderation

   Server Settings › Safety Setup › “Require 2FA for moderator actions”. Once on, staff without 2FA can’t use powerful permissions such as Administrator, Ban and Kick, Manage Server, Channels, Roles, Messages and Webhooks. It protects you if a moderator’s password leaks. You need 2FA on your own account before you can turn it on. Timeouts (Moderate Members) aren’t covered.

7. 7. Check it with Kipp

   Kipp’s checklist and /troubleshoot warn about dangerous @everyone permissions and powerful roles above Kipp, and the Server rating explains each fix.

   /kipp checklist · Dashboard: Overview › Server rating