RBAC

<-Back-to:Documentation Index

Overview

Role-Based Access Control (RBAC) is AzerothCore's permission system. It provides fine-grained control over what each account can do — from individual commands to gameplay privileges like skipping the login queue or joining battlegrounds.

With RBAC you can:

• Control access to every command individually
• Create roles that bundle related permissions together
• Override specific permissions per account without changing their overall rank
• Let modules register their own permissions without conflicting with core IDs

Architecture

The RBAC system is built on four concepts:

1. Permissions — Individual capabilities (e.g. "can use .tele", "skip queue", "join battlegrounds")
2. Roles — Permissions that link to other permissions, forming a group. Granting a role grants everything it contains
3. Defaults — Mappings from account_access.gmlevel to an initial RBAC role, so security levels map to permission sets automatically
4. Account Overrides — Per-account grants or denies that fine-tune access beyond the defaults

Database Tables

A convenience view vw_rbac joins the linked and default tables for easier querying.

Permission ID Ranges

Role Hierarchy

Roles inherit from each other through linked permissions. Each higher role links to the one below it, so an Administrator automatically receives every permission a Player has.

Administrator (192)
├── Core admin perms (7, 21, 42, 43)
├── Admin Commands (196)
└── Gamemaster (193)
    ├── Core GM perms (45, 48, 52, 53)
    ├── GM Commands (197)
    └── Moderator (194)
        ├── Core mod perms (1, 2, 9, 11, 13–47, 51, ...)
        ├── Mod Commands (198)
        └── Player (195)
            ├── Core player perms (3, 4, 5, 6, 24, 49, 50)
            └── Player Commands (199)

Default Security Level Mapping

When a player logs in, their account_access.gmlevel determines which role they receive:

These defaults are stored in rbac_default_permissions.

Permission Resolution

When an account's permissions are calculated, the following steps occur:

1. Collect grants — Account-specific grants from rbac_account_permissions plus defaults from rbac_default_permissions
2. Expand grants — Each granted permission is expanded recursively through rbac_linked_permissions. If permission 192 links to 193, and 193 links to 194, all are included
3. Collect denies — Account-specific denies from rbac_account_permissions
4. Expand denies — Denied permissions are also expanded through linked permissions
5. Subtract — Final permissions = Expanded Grants − Expanded Denies

This means denying a role denies everything that role contains.

Commands

The .rbac commands allow live management of account permissions without restarting the server.

Changes take effect immediately for online players.

Module Integration

Modules can register their own RBAC permissions using the module_rbac_permissions table. Each module uses local IDs (1, 2, 3, ...) that are automatically mapped to global IDs starting at 100000, avoiding conflicts with core permission IDs and between modules.

See module_rbac_permissions for the full integration guide.