Permissions

The four Argus permissions and how the monitoring model works — who is watched, who is exempt, who can look.

Argus v1.1.1Paper · Purpur · Folia-safe1.21 – 1.21.x

Argus has four permissions. Two of them decide who is watched, which is the part people get wrong on the first day.

Permission	Default	Purpose
`argus.admin`	`op`	Open the GUI, run every sub-command, clear scores.
`argus.monitored`	`false`	Players holding this are watched. Nothing is scored without it.
`argus.exempt`	`false`	Never scored or flagged — for the owner.
`argus.alerts`	`op`	Receive in-game high-threat alerts.

The monitoring model

Argus is opt-in by design. A fresh install watches nobody, because silently scoring every operator on the server is a good way to generate noise and bad feelings on day one.

BASH

# the ranks you want supervisedlp group helper permission set argus.monitored truelp group moderator permission set argus.monitored truelp group admin permission set argus.monitored true # the person who owns the serverlp user YourName permission set argus.exempt true # who may look at the resultslp group admin permission set argus.admin truelp group admin permission set argus.alerts true

argus.admin does not imply argus.monitored

They are independent on purpose. A senior admin can be allowed to open the GUI while also being watched — that is the normal setup. Only argus.exempt removes somebody from scoring.

How exempt actually behaves

argus.exempt suppresses scoring and flagging for that member. It does not make them invisible: ordinary actions still land in the audit log, because the log is the evidence trail and a gap in a hash chain is worse than a boring entry.

There is one deliberate exception. Unban review runs before the monitored check, so a ban reversal by a non-monitored senior still triggers the review that flags whoever placed the original ban. Without that, the abuse pattern "junior bans, senior quietly unbans" would be invisible.

Alerts

argus.alerts decides who sees in-game alerts once a member crosses alerts.min-stars. It is separate from argus.admin so you can page a small on-call group without giving everybody the ability to clear scores.

Discord alerts are configured globally and ignore this permission — see Configuration.

A worked example

A four-rank team:

Rank	`argus.admin`	`argus.monitored`	`argus.exempt`	`argus.alerts`
Owner	yes	no	yes	yes
Admin	yes	yes	no	yes
Moderator	no	yes	no	no
Helper	no	yes	no	no

Admins are both watchers and watched. That is the point: the rank most able to cause damage is the rank most worth scoring, and the audit chain means an admin cannot erase their own entries without /argus verify catching it.