> For the complete documentation index, see [llms.txt](https://docs.sonoransoftware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonoransoftware.com/store/sonoran-station-displays/permissions.md).

# Permissions

`Config.PermissionMode` supports `ace` (default) or `custom`. There is no built-in QBCore/ESX job mode.

## Logical actions

| Action         | Default ACE                           | Controls                                         |
| -------------- | ------------------------------------- | ------------------------------------------------ |
| `menu`         | `sonoran.stationdisplay.menu`         | Open the administrative management menu.         |
| `place`        | `sonoran.stationdisplay.place`        | Create a validated nearby display.               |
| `edit`         | `sonoran.stationdisplay.edit`         | Change settings, name, or transform.             |
| `delete`       | `sonoran.stationdisplay.delete`       | Delete a validated nearby display.               |
| `diagnostics`  | `sonoran.stationdisplay.diagnostics`  | In-game/server diagnostics and full resync.      |
| `forceRefresh` | `sonoran.stationdisplay.refresh`      | Refresh a selected display.                      |
| `webhookTest`  | `sonoran.stationdisplay.webhook.test` | Send a rate-limited administrative webhook test. |

Viewing displays does not require an ACE. Full sync, live cache updates, page scrolling, map panning, and eligible bodycam subscriptions are public and remain subject to server-side validity, distance, routing bucket, interior, cooldown, and rate-limit checks.

The server supplies a permission snapshot to build the menu, then revalidates every player action. A **No permission** entry or locally altered client grants no authority.

## Administrator

```ini
add_ace group.admin sonoran.stationdisplay.menu allow
add_ace group.admin sonoran.stationdisplay.place allow
add_ace group.admin sonoran.stationdisplay.edit allow
add_ace group.admin sonoran.stationdisplay.delete allow
add_ace group.admin sonoran.stationdisplay.diagnostics allow
add_ace group.admin sonoran.stationdisplay.refresh allow
add_ace group.admin sonoran.stationdisplay.webhook.test allow
```

## Menu-only group

```ini
add_ace group.stationdisplaymenu sonoran.stationdisplay.menu allow
```

This group can open the administrative menu and inspect nearby displays, but it cannot place, configure, refresh, diagnose, or delete them. No group grant is needed merely to view an in-world display.

## Dispatcher management

```ini
add_ace group.dispatchmanagement sonoran.stationdisplay.menu allow
add_ace group.dispatchmanagement sonoran.stationdisplay.edit allow
add_ace group.dispatchmanagement sonoran.stationdisplay.diagnostics allow
add_ace group.dispatchmanagement sonoran.stationdisplay.refresh allow
```

This group can open the menu, configure, move, refresh, and diagnose displays but cannot place or delete them.

## ACE inheritance

```ini
add_principal group.admin group.dispatchmanagement
add_ace group.admin sonoran.stationdisplay.place allow
add_ace group.admin sonoran.stationdisplay.delete allow
add_ace group.admin sonoran.stationdisplay.webhook.test allow
```

FiveM evaluates allow/deny rules and principal inheritance. Inspect inherited deny rules when an expected grant fails.

## Custom mode

```lua
Config.PermissionMode = "custom"

Config.CustomPermission = function(source, action)
    return MyPermissionResource.CanUseStationDisplays(source, action)
end
```

The callback receives backend actions:

```
menu
place
edit
delete
diagnostics
refresh
webhookTest
```

The `forceRefresh` logical action resolves to the `refresh` backend action. The callback runs inside `pcall`. Only boolean `true` allows; errors and other return values deny.

## Server validation

Depending on the request, the server checks:

* The current permission
* Display existence and maximum count
* Model allowlist
* Name, enum, page, and numeric ranges
* At least one enabled page
* Player proximity
* Routing bucket and interior context
* Page/action validity and cooldown
* Per-player event rate limits

Save/delete/move operations also validate the player against the saved/final position. A client cannot authorize itself by changing local state.

## Data access

Every player receives sanitized display definitions and live board data. There is no viewing ACE. Bodycam image delivery additionally requires an eligible subscription and passes distance, routing bucket, interior, feed, payload, and rate-limit validation.

Caller normalization is disabled by default and caller text is not rendered. That does not make every call field suitable for a public-facing screen; review address and description settings.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.sonoransoftware.com/store/sonoran-station-displays/permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.