I have all permissions but using /god player where player is another user with no permissions and auth level 0, the plugin reports that I have set god mode for them yet they still take damage from everything.

That command does not GIVE godmode, it toggles it for the player. So if they do not have permissions set, it will not toggle for them.

Ah, I see! Thanks for the clarification. When I used the command the player did see a message saying god mode had been set on them and they were listed under /gods - hence my confusion.

It probably needs some tweaks to that.