Two layers: the server, then the channel
Server-wide permissions come from each role (Server Settings → Roles). On top of that, every category and channel can have its own settings for @everyone, for specific roles, and for specific members. Those channel settings are what make a channel private or read-only.
Set it on the category, not every channel
A channel can stay "synced" with its category: it then follows the category's settings automatically, and new channels you add there do too. Set access once on the category and let its channels follow. As soon as you change a channel's own permissions it stops syncing, so only do that when one channel really needs to differ.
A private area (staff only, members only)
- On the category, set @everyone → View Channel to deny.
- Add the roles that should see it (for example Officer) and set View Channel to allow.
- Add your bots too if they need to post or read there (logs, tickets): a bot that can't see a channel can't use it.
A read-only channel (announcements, rules)
- On the channel, set @everyone → Send Messages to deny.
- Allow Send Messages for the roles that should post (staff).
- Leave View Channel alone so everyone can still read it.
How Discord decides, in order
For each channel, Discord starts from someone's server-wide permissions, then applies the channel's @everyone setting, then the settings for their roles (an allow on any of their roles beats a deny on another), and finally any setting for that member personally. Administrator skips all of it.
Mistakes that lock people out
- Denying @everyone View Channel on a category without allowing any role: nobody but admins can see it.
- Forgetting your bots in a private category: logs, tickets or role pickers there stop working.
- Editing one channel and not noticing it stopped syncing: later changes to the category no longer reach it.
How Foreman handles it
In the Builder's Access tab you set who can see each category and channel in one grid, and Foreman applies it. /permissions check finds channels that don't match their category, and every push from the website starts with a check that lists problems before anything changes.