Permissions

The checks live on the commands. The menus and the in-drill hotbar do not ask for them. A player without exyliaaimtrainer.train cannot type /aim train, but can open /aim, click Drills and start any of them; the same goes for settings, profiles, leaderboards, history, sending a duel from the opponent picker, and the leave buttons.

The one exception is answering a duel: the Accept and Decline buttons in the request run /aim accept and /aim deny, so those clicks do check exyliaaimtrainer.duel.

To keep a group out of a feature, take the main menu away from them as well — for instance by blocking /aim, /aimtrainer and /at with your command manager — rather than relying on the node alone.

Every staff screen is reached through /aimtraineradmin, which does check exyliaaimtrainer.admin. The actions behind those screens — aimtrainer:admin_arena_delete_do, aimtrainer:admin_player_reset_do and the rest — do not check it themselves. Never bind an aimtrainer:admin_* action to an item in a player-facing menu or in another plugin's file: whoever clicks it runs it.

There are no permission nodes for individual drills, formats, colours, styles or arenas, and none that lets a player run blocked commands while inside a drill. A player who may train may train every configured drill at any size and distance inside the configured range.