Capability catalog
Everything AEGIS does, in depth
Five systems working as one platform: moderation with real case management, structured incident response, appeals with role-based access control, a tamper-evident audit trail, and operations tooling built on real events — never invented numbers.
Moderation & cases
Warn, note, timeout, kick, ban, tempban, softban, quarantine, purge, slowmode, channel lock, and more — and every subject-targeted action produces a numbered case, even when Discord rejects the action, so nothing disappears silently.
Case lifecycle
Cases get guild-sequential numbers allocated transactionally (collision-free under concurrency). Each records subject, moderator, actor type (moderator, Sentinel, or system), action, reason, public explanation, status, appeal status, incident link, and expiry — with append-only history and internal notes.
- open
- resolved
- reversed
- expired
Hierarchy rules
Every action passes a pure, unit-tested hierarchy check before it reaches Discord:
- The server owner can never be targeted. No configuration overrides this.
- Targets at or above the bot's highest role are refused before Discord would reject them.
- Moderators cannot act on members ranked equal to or higher than themselves.
- Protected staff roles are shielded unless the guild explicitly opts in to allow actions on protected staff.
Confirmation workflow
Ban, tempban, and softban always present a confirmation panel. The confirm button resolves durable server-side state, is usable only by the initiating moderator, and is consumed atomically — double-clicks and replays cannot double-execute, and panels survive bot restarts.
Temporary actions (tempban, quarantine, timeout) are scheduled in Postgres and reversed automatically by the worker, with retry, backoff, and a manual-follow-up flag when Discord keeps refusing.
Incident response
Cases cover member enforcement; incidents cover broader security events. Each incident has a severity, a commander, members, resources, containment notes, a resolution summary, and an append-only timeline. State transitions are enforced by a state machine — illegal transitions are rejected.
- Observe: Gateway and audit-log events stream in as structured, guild-scoped facts.
- Detect: Events become scored signals with visible risk factors.
- Contain: Mode-gated responses limit damage — slowdown, quarantine, lockdown — within budgets you set.
- Investigate: Incidents collect signals, cases, and timeline notes into one reviewable picture.
- Enforce: Actions pass hierarchy checks and become numbered, appealable cases.
- Audit: Every step lands in a hash-chained, append-only audit log.
- Improve: False-positive reviews and rule-execution records feed detection tuning.
- Observe
- Detect
- Contain
- Investigate
- Enforce
- Audit
- Improve
- Observe
- Gateway and audit-log events stream in as structured, guild-scoped facts.
- Detect
- Events become scored signals with visible risk factors.
- Contain
- Mode-gated responses limit damage — slowdown, quarantine, lockdown — within budgets you set.
- Investigate
- Incidents collect signals, cases, and timeline notes into one reviewable picture.
- Enforce
- Actions pass hierarchy checks and become numbered, appealable cases.
- Audit
- Every step lands in a hash-chained, append-only audit log.
- Improve
- False-positive reviews and rule-execution records feed detection tuning.
| Type | Opened | What it covers |
|---|---|---|
| raid | Automatic | Corroborated join-wave verdicts open (or append to) a single active raid incident per guild. |
| anti_nuke | Automatic | An exceeded action budget opens an incident recording the actor, threshold, and containment outcome. |
| compromised_staff | Manual | Suspected takeover of a staff account; containment can quarantine the actor and strip dangerous roles. |
| spam_campaign | Manual | Sustained spam activity across members or channels, tracked as one investigation. |
| phishing_campaign | Manual | Coordinated malicious-link posting, with linked signals and cases. |
| mass_ban | Manual | Review of unusually high ban volume, whether malicious or mistaken. |
| config_compromise | Manual | Suspicious configuration changes; versioned config supports rollback. |
| webhook_compromise | Manual | Webhook abuse tracked with the webhook create/delete budgets that detected it. |
| coordinated_abuse | Manual | Multi-account harassment or evasion handled as one case-linked incident. |
| custom | Manual | Anything else your team wants a timeline and commander for. |
Appeals & role-based access control
AEGIS RBAC is first-class and independent of raw Discord permissions — Discord flags only affect command visibility, and every consequential path re-checks AEGIS permissions server-side. Eleven built-in roles ship out of the box; guilds can add custom roles.
| Built-in role | Permissions |
|---|---|
| Organization / Guild Owner | All permissions (wildcard). The guild owner is the only implicit grant in the system. |
| Security Administrator | Full case, incident, Sentinel, evidence, appeals, audit, config, integrations, and lockdown permissions. |
| Incident Commander | Read/create cases; manage incidents; investigate members; reveal evidence; activate and release lockdown. |
| Senior Moderator | Full case lifecycle including reversals; read incidents; investigate members; review appeals; read config. |
| Moderator | Read and create cases; investigate members. |
| Investigator | Read cases and incidents; investigate members; reveal evidence. |
| Analyst | Read cases and incidents; run Sentinel simulations; read the audit log. |
| Appeals Reviewer | Read cases; review appeals. |
| Auditor | Read cases, incidents, and the audit log; export audit data. |
| Read-Only Observer | Read cases, incidents, and config. No mutations. |
Separation of duties
When separation of duties is on (the default), high-impact review actions — appeal decisions and case reversals — cannot be performed solely by the moderator who took the original action. The check is enforced in both the bot command and the dashboard endpoint, because both surfaces resolve the same RBAC tables.
Structured appeals
Subjects appeal cases through a structured flow with a written statement. Reviewers see the case history, decide with a recorded reason, and the decision is audited. Subjects are notified with their case number and appeal outcome (best-effort DM, configurable).
Audit & integrity
Every administrative and automated action is written to an append-only audit log with correlation IDs, chained per guild with SHA-256 hashes. Tampering doesn't go unnoticed: mutate one row and every subsequent hash stops matching.
- prev
- b7e0…334c
- hash
- 9f2c…a1d4
- prev
- 9f2c…a1d4
- hash
- 5d81…e772
- prev
- 5d81…e772
- hash
- c04a…19bf
Honest scope: the chain makes tampering detectable, not impossible — a database superuser could still delete rows, which is why deployments pair it with WAL archiving and offsite backups. Details on the security page.
Operations
Command Center dashboard
Threat posture, live signal feed, cases, incidents, appeals queue, audit search, and a config viewer — with access authorized by the API on every request, never the browser.
Analytics from real events
Every chart is an aggregate of events that actually happened — hourly rollups of signals, cases, and incidents. No projections, no invented numbers, and dashboards state the retention caveats that apply.
Discord-native surface
A compact slash-command surface (/aegis, /security, /moderation, /case, /incident, /member, /appeal, /config, /audit, /status) plus context menus and persistent panels — staff can run a whole incident without leaving Discord.