diff --git a/static/sfu.js b/static/sfu.js
index 5cec8f0..047c3e1 100644
--- a/static/sfu.js
+++ b/static/sfu.js
@@ -1058,7 +1058,8 @@ function handleInput() {
                     return;
                 }
                 send({
-                    type: 'clearchat',
+                    type: 'groupaction',
+                    kind: 'clearchat',
                 });
                 return;
             case '/lock':
@@ -1068,7 +1069,8 @@ function handleInput() {
                     return;
                 }
                 send({
-                    type: cmd.slice(1),
+                    type: 'groupaction',
+                    kind: cmd.slice(1),
                 });
                 return;
             case '/record':
@@ -1078,7 +1080,8 @@ function handleInput() {
                     return;
                 }
                 send({
-                    type: cmd.slice(1),
+                    type: 'groupaction',
+                    kind: cmd.slice(1),
                 });
                 return;
             case '/op':
@@ -1106,7 +1109,8 @@ function handleInput() {
                     return;
                 }
                 send({
-                    type: cmd.slice(1),
+                    type: 'useraction',
+                    kind: cmd.slice(1),
                     id: id,
                 });
                 return;
diff --git a/webclient.go b/webclient.go
index 81d5f8c..77dfc59 100644
--- a/webclient.go
+++ b/webclient.go
@@ -1006,71 +1006,81 @@ func handleClientMessage(c *webClient, m clientMessage) error {
 				cc.write(m)
 			}
 		}
-	case "clearchat":
-		c.group.clearChatHistory()
-		m := clientMessage{Type: "clearchat"}
-		clients := c.group.getClients(nil)
-		for _, cc := range clients {
-			cc, ok := cc.(*webClient)
-			if ok {
-				cc.write(m)
+	case "groupaction":
+		switch m.Kind {
+		case "clearchat":
+			c.group.clearChatHistory()
+			m := clientMessage{Type: "clearchat"}
+			clients := c.group.getClients(nil)
+			for _, cc := range clients {
+				cc, ok := cc.(*webClient)
+				if ok {
+					cc.write(m)
+				}
 			}
-		}
-	case "op", "unop", "present", "unpresent":
-		if !c.permissions.Op {
-			return c.error(userError("not authorised"))
-		}
-		err := setPermissions(c.group, m.Id, m.Type)
-		if err != nil {
-			return c.error(err)
-		}
-	case "lock", "unlock":
-		if !c.permissions.Op {
-			return c.error(userError("not authorised"))
-		}
-		var locked uint32
-		if m.Type == "lock" {
-			locked = 1
-		}
-		atomic.StoreUint32(&c.group.locked, locked)
-	case "record":
-		if !c.permissions.Record {
-			return c.error(userError("not authorised"))
-		}
-		for _, cc := range c.group.getClients(c) {
-			_, ok := cc.(*diskClient)
-			if ok {
-				return c.error(userError("already recording"))
+		case "lock", "unlock":
+			if !c.permissions.Op {
+				return c.error(userError("not authorised"))
 			}
-		}
-		disk := &diskClient{
-			group: c.group,
-			id:    "recording",
-		}
-		_, err := addClient(c.group.name, disk)
-		if err != nil {
-			disk.Close()
-			return c.error(err)
-		}
-		go pushConns(disk)
-	case "unrecord":
-		if !c.permissions.Record {
-			return c.error(userError("not authorised"))
-		}
-		for _, cc := range c.group.getClients(c) {
-			disk, ok := cc.(*diskClient)
-			if ok {
+			var locked uint32
+			if m.Kind == "lock" {
+				locked = 1
+			}
+			atomic.StoreUint32(&c.group.locked, locked)
+		case "record":
+			if !c.permissions.Record {
+				return c.error(userError("not authorised"))
+			}
+			for _, cc := range c.group.getClients(c) {
+				_, ok := cc.(*diskClient)
+				if ok {
+					return c.error(userError("already recording"))
+				}
+			}
+			disk := &diskClient{
+				group: c.group,
+				id:    "recording",
+			}
+			_, err := addClient(c.group.name, disk)
+			if err != nil {
 				disk.Close()
-				delClient(disk)
+				return c.error(err)
 			}
+			go pushConns(disk)
+		case "unrecord":
+			if !c.permissions.Record {
+				return c.error(userError("not authorised"))
+			}
+			for _, cc := range c.group.getClients(c) {
+				disk, ok := cc.(*diskClient)
+				if ok {
+					disk.Close()
+					delClient(disk)
+				}
+			}
+		default:
+			return protocolError("unknown group action")
 		}
-	case "kick":
-		if !c.permissions.Op {
-			return c.error(userError("not authorised"))
-		}
-		err := kickClient(c.group, m.Id)
-		if err != nil {
-			return c.error(err)
+	case "useraction":
+		switch m.Kind {
+		case "op", "unop", "present", "unpresent":
+			if !c.permissions.Op {
+				return c.error(userError("not authorised"))
+			}
+			err := setPermissions(c.group, m.Id, m.Kind)
+			if err != nil {
+				return c.error(err)
+			}
+		case "kick":
+			if !c.permissions.Op {
+				return c.error(userError("not authorised"))
+			}
+			err := kickClient(c.group, m.Id)
+			if err != nil {
+				return c.error(err)
+			}
+		default:
+			return protocolError("unknown user action")
 		}
 	case "pong":
 		// nothing