Permissions and capabilities
A resource lists the privileged actions it needs in its manifest’s permissions. Calling an API without its
permission fails.
| Permission | Allows |
|---|---|
vehicle.control |
Writing the local bus’s script variables and triggers. |
vehicle.spawn |
Spawning and despawning the local bus. |
vehicle.admin |
The authority despawning another player’s bus. |
world.control |
The authority changing time and weather. |
network.events |
Sending custom network events. |
network.metadata |
Writing synced and stream-synced metadata. |
ui.hud |
Text overlays and interactive panels. |
input.commands |
Watching and holding keyboard.cfg commands. |
audio.behaviour |
Supported audio behaviour changes. |
player.messages |
Authority announcements to players. |
storage |
Saving files in the resource’s data folder. |
The same names are available as constants on ResourcePermissions.
Capabilities
Section titled “Capabilities”Runtime.Capabilities (ResourceCapabilities) says what the current
host side actually implements. A permission does not create a missing capability, and a capability does not grant a
permission. Check capabilities when one resource should work on both the client and a dedicated server.
Permissions are API policy, not a security sandbox. See Trust and limits.