permissions & security.

the standard invite asks for basic chat, embeds, reactions, message history, application commands and voice access. it does not ask for administrator. moderation, channel management and role management need additional, action-specific permissions before you use those modules.

the exact set depends on the actions you expose. read and send access are needed anywhere havoc must receive a prefix command or post a result. add the following discord permissions only for modules you use.

configuration commands frequently require manage server or administrator from the person running them. that check is separate from havoc’s own ability to carry out the resulting action.

every command carries its own required discord permissions in the live registry. havoc checks the member’s effective permissions in the channel where the command runs. administrator satisfies discord permission checks, but does not bypass server-owner-only rules or role hierarchy.

,help ban
,help purge
,help config

::ban members

required for ban-family actions; it does not imply manage server.

::manage messages

used for purge, snipe-cache controls, embeds, and sending exact text.

::manage server

used by module configuration and command restrictions.

::administrator

required by the core config family and server-prefix changes.

::server owner

required in addition to administrator for the antinuke administrator list.

,help <command> reports the current requirement. use it before creating a staff role rather than granting administrator to solve one denied command.

permissions authorize an action; hierarchy decides which target is reachable. havoc cannot moderate a member whose highest role is at or above havoc’s highest role. except for the server owner, a moderator also cannot target themselves or anyone whose highest role is at or above their own.

role commands reject the default role, managed integration roles, roles at or above havoc, and roles at or above the acting member. the server owner and havoc itself are never moderation targets. move havoc’s role above every role it should manage, but keep it below trusted administrator roles.

without administrator, channel and category overwrites affect havoc just like any member. it needs view channel to receive commands, send messages to answer, read message history for lookups and reply targeting, and manage messages for deletion. logging destinations must allow havoc to view and send there even if ordinary members cannot.

staff permissions are also evaluated in the current channel. a role may have manage messages at server level and still be denied where an overwrite removes it. run a diagnostic command in the same channel where the real action fails, then inspect both the member’s and havoc’s effective channel permissions.

command restrictions add role membership on top of discord permissions. they are useful when several teams share the same discord permission but only one should use a particular havoc command. a parent restriction covers its subcommands, and satisfying the role gate never grants the command’s underlying permission.

,restrictcommand add ban @moderator
,restrictcommand add "config view" @administrator
,restrictcommand list

setup is a read-only guide available to server members. the core config family and server-prefix changes require administrator from the person running them. the antinuke list additionally requires the server owner. module configuration commonly requires manage server; setupmuterequires manage server and manage channels. these checks do not grant havoc the bot permissions needed for those actions.

the web dashboard first requires that the signed-in discord account can manage the server. the bot API then performs action-specific permission and hierarchy checks again. see web dashboard for the implemented browser surfaces.

most prefix replies are ordinary channel messages, and most slash replies are visible to the channel. a small set of self-serve or diagnostic commands, including help and the confirmation from say, uses an ephemeral slash response. commands whose typed input is marked private attempt to delete the prefix invocation before checking or processing it; if deletion fails, the handler is told not to leak the content farther.