Give the moderator permissions that only allow him to do what he can do. Player management, world editing, and server settings can be separate permission groups.
Step by step
-
Get the list of current groups and OPs. Check which groups the people who have completed their duties remain in.
-
Identify the commands the moderator needs. Verify each command's permission node separately in its plugin documentation.
-
Add permissions to the role and apply with a normal test account. While the required process such as ban is running, the server setting and OP granting should be rejected.
-
If you are using world or server contexts, try the lobby and survival separately. After removing the authorization, check the result by logging in again.
Keep in mind
Old permissions granted directly to the player may remain after the group is removed.