Permissions

Permissions

TeamSpeak's permission system is the part that costs administrators the most time. This page explains the model first, then the tools this app gives you for working with it.

The five layers

A permission can be granted in five different places. TeamSpeak calls them tiers:

Tier	Layer	What it is
1	Server Group	A group a client belongs to. Applies everywhere on the server. A client can be in several at once
2	Client	Set directly on one specific client, server-wide
3	Channel	A property of the channel itself — e.g. the talk power needed to speak in it, or its icon (i_icon_id, which the Edit Channel dialog sets — see Channels)
4	Channel Group	A group a client holds within one channel. Every client is in exactly one per channel
5	Client in Channel	One client, in one specific channel. The narrowest possible scope

If a permission isn't set on any layer, it counts as zero or false.

Which layer wins

A higher tier overwrites a lower one. In order:

Server Group → Client → Channel → Channel Group → Client in Channel

This surprises people, so it is worth stating plainly: a channel group beats a permission set directly on the client. Being "personally" granted something does not make it win.

This is documented in doc/server/permissiondoc.txt, which ships with the TeamSpeak server itself — worth reading in full if you administer permissions regularly. Explanations found elsewhere online sometimes state a different order, so prefer that file.

Several groups, same permission

Within a single tier — a client in three server groups, all granting i_client_kick_power — the highest value wins.

The negate flag

Negate exists to build groups that take something away. If any entry for that permission carries the negate flag, the result within that tier is the lowest negated value instead of the highest.

The classic use is a "Sticky" group containing only i_channel_join_power = -1 with negate set. Anyone put in it can no longer switch channels, even if another of their groups grants a positive value.

The skip flag

Skip protects a permission from being overridden by the channel layers. Set on a Server Group (1) or Client (2) permission, it means that permission "will not be altered by any overlapping permission in the Channel Groups (Tier 4) or the Channel (Tier 3) layer".

This is how an admin group stays immune to channel groups: without skip, any channel group could quietly restrict your administrators inside a channel.

Note that skip does not protect against Tier 5 (Client in Channel) — the documentation names only tiers 3 and 4.

The Permissions page

Five tabs correspond to the five layers above, plus two tools that work across all of them. Admins get a third one, Automatic Groups, which works differently from everything else on the page.

Editing one entity

Pick a layer, pick an entity on the left, edit its permissions on the right. Permissions are grouped into categories; use the search box to narrow down.

• Only show set hides everything this entity doesn't explicitly define — usually what you want, since the full list is around 500 entries.
• Advanced / Simple switches what each row is labelled with. Advanced shows the raw name (b_virtualserver_create), Simple shows TeamSpeak's own plain-language description ("Create virtual servers"). Whichever isn't shown appears on hover. This applies everywhere, including the dialogs.

The Client in Channel tab works differently from the others by necessity: TeamSpeak has no command to list every channel-client override that exists on a server, so there is nothing to browse. Pick a channel, then add the clients you want to work on.

Bulk Apply

Select several entities with the checkboxes, and you get Bulk Apply: set a value once and push it to all of them. Each row shows what the selection holds — the value they all share, mixed where they differ or only some have it (hover to see each one's own value), or the usual empty field where none has it. For every entity side by side, use Compare instead.

• Removing a permission from all of them: empty a shared value, untick a granted boolean, or use the row's remove button. A mixed row is removed with the remove button only — typing a value into it and deleting it again just takes the typing back.
• Booleans are three-state: granted, not set, or a dash for mixed. Clicking a mixed one grants it to every selected entity.
• Only show set works here too and lists what at least one of the selected entities has.
• Nothing is written until you press Apply to N.

Compare

With several entities selected, switch to Compare to see them side by side, one column each, and edit any single cell independently.

• With three or fewer entities, every row colours itself automatically: red is the highest value in that row, green the lowest, yellow a tie or the middle value, pink means not set. No clicking required.
• With more than three, that ranking stops making sense, so it falls back to a reference-based scheme: click any cell to pin it, and the rest of that row colours relative to it.
• Add/Remove Perm controls which permissions are listed. Everything is shown by default; untick what you don't care about. It is organised into category tabs with a select-all per tab.
• Add Target loads a previously exported group file as an extra, read-only column — useful for comparing a live group against a saved reference or against a group from another server.
• Only show differing hides every row where all columns agree.

Find Permission

The reverse lookup: "where is this permission actually set?"

Pick a permission and get every place it is assigned across all five layers, with the entity's real name and the value. Clicking a result opens it in the editor.

Useful when you know something is granting an ability but not where it comes from.

Permission Overview

Pick a client and a channel, and see every permission that applies to them there, with the layer each one comes from.

Where several layers grant the same permission, the winning one is highlighted and the losing sources stay listed, struck through with their values. That is deliberate: TeamSpeak reports every contributing layer but never tells you which one it actually used, and there is no command that reveals the effective value for another client. The winner is therefore calculated here, following the tier rules above — so the raw sources stay visible for you to check.

Automatic Groups

Admins only. This is the one mode that does not edit a single entity: it adds permissions to, or removes them from, a whole kind of server group at once, on every virtual server of the TeamSpeak instance. It is TeamSpeak's own servergroupautoaddperm and servergroupautodelperm.

TeamSpeak finds the groups by a number kept in each group's i_group_auto_update_type permission:

Type	Name
10	Channel Guest
15	Server Guest
20	Query Guest
25	Channel Voice
30	Server Normal
35	Channel Operator
40	Channel Admin
45	Server Admin
50	Query Admin

1. Open Permissions and choose Automatic Groups, the last button in the row after Permission Overview. Other roles don't see it.
2. Pick Add Permissions or Remove Permissions, then the group type.
3. Tick the permissions on the left. For Add, each one gets its value on the right: a box for a b_ permission (on by default), a number for any other, which stays empty until you type one. Skip and Negate are ticked per permission.
4. Press the button at the bottom. A confirmation window names the action, the type, the permissions and the scope, and nothing is sent until you accept it.

What to know before you do:

• Every virtual server, not just the one you are looking at. The change reaches the matching groups on all virtual servers of the instance, not only the one selected in the sidebar. Groups that already exist change straight away.
• Regular groups only. The match is on the permission's value, as TeamSpeak's own documentation for the command puts it, and only regular server groups (the kind you can put clients in) are changed. The template groups (see Tips and Pitfalls) and the two built-in Server Query groups carry the same permission but were left alone when this was tried on a TeamSpeak 6 server (6.0.0-beta13.1), so Query Guest changed nothing there. A group you made yourself is included only if it carries the permission with that value.
• Add overwrites. A group that already has the permission gets the new value, Skip and Negate in place of the old ones. Remove takes the permission away from those groups completely.
• There is no undo. Neither command remembers what was there before. Export the groups first: Compare's Add Target can then show you the original next to the live group.
• The query login needs a permission for it. TeamSpeak asks for b_permission_modify_power_ignore on both commands. The default serveradmin query login has it; with a more restricted login TeamSpeak refuses, and the page shows its message.

To see which groups would take part before you press anything, use Find Permission on i_group_auto_update_type: it lists the regular server groups that carry it, with the number each holds. It lists channel groups too, which these two commands don't touch.

Exporting and importing groups

On the Server Groups and Channel Groups pages you can select groups with checkboxes and export them to a JSON file containing each group's name and full permission set. Import reads that file back and creates new groups — it never overwrites an existing group, even on a name collision.

Deliberately, exports contain permissions only, not membership: the clients on a target server are usually different people entirely.

---

v0.7, last edited 06.10.2026