The Discord Permission Mistakes an AI Build Prevents
Almost every "our Discord leaked something" story is a permission mistake, not a hack. A channel that was meant to be staff-only was readable by everyone, and nobody noticed until someone read it.
Discord's permission model is powerful and genuinely hard to hold in your head: server-level permissions, category overrides, channel overrides, role hierarchy, and @everyone as a role that behaves like a floor. This is a list of the mistakes that recur, and what changes when a build is planned before it is applied.
Why are Discord permissions so easy to get wrong?
Because the interface shows you one channel at a time, and the mistakes live in the relationships between channels. A permission matrix is a good editor and a bad reviewer. You can check any single channel easily and still have no idea whether the set is consistent.
That asymmetry is the root cause of every item below.
Mistake 1: the category override nobody checked
A channel inherits from its category unless you override it. Move a private channel into a public category and it can quietly become public, because the override you were relying on was on the category, not on the channel.
What to check: for every channel that should be private, look at the channel's own overrides rather than trusting where it sits.
Mistake 2: @everyone can read the channel you locked
Restricting a channel by granting a staff role View Channel does nothing on its own. Unless @everyone is explicitly denied View Channel, everyone still sees it — the grant added access rather than removing it.
What to check: a private channel needs @everyone denied first, then the role granted. If you only ever added a green tick, the channel is open.
Mistake 3: a role higher in the hierarchy than you meant
Discord role hierarchy decides who can moderate whom. A bot or a moderator role placed above roles it should not touch can act on people it was never meant to act on, including other staff.
What to check: open the role list and read it top to bottom as a chain of command. If a role sits above one that should outrank it, that is a live problem, not a tidiness issue.
Mistake 4: the mod log everyone can read
The most common single instance of mistake 2, and the most damaging, because a mod log contains exactly what you would not want the moderated person to see: reasons, reporter names, and internal discussion.
What to check: open your mod log channel in an incognito account with no roles. If you can read it, so can everyone else.
What does an AI build change?
It changes when you look. That is the entire mechanism, and it is worth being precise about it, because "AI" is not what fixes permissions — reviewing a whole structure at once is.
PeakBot's Onyx writes the full plan and shows it to you before anything is created: every channel, every role, and every permission override, in one view. You are reading the relationships between channels, which is the thing the permission matrix cannot show you. Nothing has touched Discord at that point, so a mistake caught there costs a follow-up message rather than an undo.
Describing the rule in words also removes a translation step. "Only officers see the mod log" is a sentence that cannot be half-applied; a green tick without a matching red one can.
| Building by hand | Plan-first AI build | |
|---|---|---|
| See one channel at a time | Yes | No, the whole set at once |
| Catch inconsistency before it is live | Rarely | Yes, it is a proposal until applied |
| Undo a mistake | Manual, per channel | Correct the plan, re-apply |
| Requires knowing the matrix | Yes | No, describe the rule |
What an AI build does not fix
It does not decide your policy. Who should see the mod log is a judgement about your team.
It does not audit what already exists unless you ask it to. An old server with years of drift needs someone to ask the question.
It does not stop a compromised account. Permissions are about who can see what. Damage done by an account that already has power is what anti-nuke limits are for, and that is a separate system.
The five-minute audit worth running today
- Open every private channel and confirm @everyone is denied View Channel on the channel itself.
- Read the role list top to bottom as a hierarchy and fix anything sitting too high.
- Open the mod log in a no-role account.
- Check which roles have Manage Roles, Manage Channels, or Administrator, and remove the ones that do not need it.
- Check where your webhooks post, because a webhook ignores channel permissions.
Where to go next
- What is Onyx? — the builder that plans before it applies.
- How to describe a server so an AI builds the right one — including how to state permission rules.
- Discord anti-nuke protection — for the damage permissions cannot prevent.
