Guardian

Per-actor 2FA confirmation layer that intercepts dangerous permission changes before they land.

Overview

Guardian sits on top of antinuke as a second line of defense. Where antinuke punishes a whitelisted admin who nukes, Guardian asks “is that really you?” before the change even takes effect. When a whitelisted admin’s account is hijacked — stolen token, cookie theft, compromised session — the attacker inherits full trust and can bypass antinuke entirely. Guardian closes that gap by requiring the real admin’s personal credential (a password in their head or a TOTP code from their authenticator) before any dangerous role or permission change is re-applied.

How it works

When an admin or attacker grants a dangerous permission to a role or member:

Intercept flow

What counts as dangerous

Trigger	When it fires
`role_admin_grant`	A role gains the `administrator` permission
`role_dangerous_perm_grant`	A role gains any of: ban, kick, manage server, manage roles, manage channels, manage webhooks, manage expressions, manage nicknames
`member_admin_role_grant`	A member is granted any role that already has `administrator`
`locked_role_grant`	A member is granted a role you’ve pinned to the locked-role list, regardless of its permissions

Credential ladder

When resolving a challenge, the input is checked in this order:

Type	Format	Notes
TOTP	6 digits	±1 step window (90s) for clock drift
Recovery code	8 hex chars	Single-use, consumed on match
User password	Any	argon2id verified
Guild master password	Any	Always works as fallback for any actor

Three wrong attempts on the same challenge locks it permanently — the change stays reverted.

Setup

Server owner: set master password

;guardian master set (strong-password)

The command auto-deletes after running. Confirm with ;guardian master status.

Each admin: enroll in DM

;guardian enroll password (guild-id) (personal-password)

Or use TOTP (see Enrollment section below). Run these in DM with the bot — they auto-delete.

Optionally lock high-value roles so any grant triggers a challenge regardless of permissions: ;guardian lock @AdminRole (master-pw)Trust legitimate bots (reaction role bots, etc.) to skip challenges: ;guardian trust add @Bot (master-pw)

Master password commands

Server owner only. All credential commands auto-delete after running.

Set master password

Syntax
Example

;guardian master set (password)

First-time setup. Server owner only.

;guardian master set MyStr0ngP@ss

First-time setup. Server owner only.

Rotate master password

Syntax
Example

;guardian master change (old) (new)

Rotate the master password without disabling Guardian.

;guardian master change OldPass NewStr0ngPass

Rotate the master password without disabling Guardian.

Enable / Disable

Syntax
Example

;guardian master enable (password)
;guardian master disable (password)

Re-enable or pause Guardian. Disable requires master password confirmation.

;guardian master enable MyPass
;guardian master disable MyPass

Re-enable or pause Guardian. Disable requires master password confirmation.

Status

Syntax
Example

;guardian master status

Show current config, active triggers, challenge window, enrollment counts, pending approvals, and enrollment policy.

;guardian master status

Show current config, active triggers, challenge window, enrollment counts, pending approvals, and enrollment policy.

Require enrollment approval

Syntax
Example

;guardian master require-approval (on|off) (master-password)

Toggle whether new enrollments need owner approval before they can confirm a challenge. When on, anyone who enrolls is in a pending state until the owner approves them. The server owner is always auto-approved. Aliases: approval, require_approval.

;guardian master require-approval on MyMasterPass
;guardian master require-approval off MyMasterPass

Turn on enrollment approval gating. Enrolled users stay in pending until you run ;guardian admin approve.

Manage triggers

Syntax
Example

;guardian master triggers add (name) (password)
;guardian master triggers remove (name) (password)
;guardian master triggers list (password)

Add or remove which event types open a challenge. Valid trigger names: role_admin_grant, role_dangerous_perm_grant, member_admin_role_grant, locked_role_grant.

;guardian master triggers add locked_role_grant MyPass
;guardian master triggers remove role_admin_grant MyPass
;guardian master triggers list MyPass

Add or remove which event types open a challenge.

Enrollment

Run all enrollment commands in DM with the bot. They auto-delete on success.

If the server has require-approval enabled, your enrollment lands in a pending state after you enroll. The server owner gets a DM and must run ;guardian admin approve @you (master) before your credential can confirm any challenge. The server owner is always auto-approved. If approval is not required, enrollment is active immediately.

Set personal password

Syntax
Example

;guardian enroll password (guild-id) (password)

Set your personal password for a specific server. DM only.

;guardian enroll password 123456789012345678 MyPersonalPass

Set your personal password for a specific server. DM only.

Set up TOTP (authenticator app)

Syntax
Example

;guardian enroll totp (guild-id)

Start TOTP enrollment. Bot DMs you a QR code — scan with Authy, Aegis, Google Authenticator, or 1Password.

;guardian enroll totp 123456789012345678

Start TOTP enrollment. Bot DMs you a QR code to scan with your authenticator app.

Verify TOTP

Syntax
Example

;guardian enroll totp verify (guild-id) (code)

Confirm your TOTP enrollment with a live code. On success, bot shows 8 single-use recovery codes — save them now.

;guardian enroll totp verify 123456789012345678 482910

Confirm your TOTP enrollment. Bot replies with 8 single-use recovery codes.

Check enrollment status

Syntax
Example

;guardian enroll status (guild-id)

See which credentials you have enrolled for a server.

;guardian enroll status 123456789012345678

See which credentials you have enrolled for a server.

Remove enrollment

Syntax
Example

;guardian unenroll (guild-id) (credential)

Drop your own enrollment. credential is password, totp, or all. DM only.

;guardian unenroll 123456789012345678 totp

Drop your TOTP enrollment. DM only.

Role locking

Lock a role so that any grant of it triggers a challenge, regardless of the role’s permissions.

Lock a role

Syntax
Example

;guardian lock @role (master-password)

Add a role to the locked list. Requires master password.

;guardian lock @Admin MyMasterPass

Add a role to the locked list. Requires master password.

Unlock a role

Syntax
Example

;guardian unlock @role (master-password)

Remove a role from the locked list.

;guardian unlock @Admin MyMasterPass

Remove a role from the locked list.

List locked roles

Syntax
Example

;guardian locked

List all currently locked roles. Paginated, 10 per page.

;guardian locked

List all currently locked roles. Paginated, 10 per page.

Trusted bots

Bots in the trust list skip all Guardian challenges — useful for reaction role bots, auto-role bots, or any bot that legitimately grants roles.

Trust a bot

Syntax
Example

;guardian trust add @bot (master-password)

Add a bot to the trust list. Server owner only.

;guardian trust add @ReactionRoleBot MyMasterPass

Add a bot to the trust list. Server owner only.

Untrust a bot

Syntax
Example

;guardian trust remove @bot (master-password)

Remove a bot from the trust list.

;guardian trust remove @ReactionRoleBot MyMasterPass

Remove a bot from the trust list.

List trusted bots

Syntax
Example

;guardian trust list

Show all trusted bots. Paginated, 10 per page.

;guardian trust list

Show all trusted bots. Paginated, 10 per page.

Admin commands

Approve a pending enrollment

Syntax
Example

;guardian admin approve @user (master-password)

Approve a member’s pending guardian enrollment. Owner only. Once approved, their credential is active and can confirm future challenges. The member gets a DM on approval.

;guardian admin approve @wanderer MyMasterPass

Activate wanderer’s pending enrollment.

Reject a pending enrollment

Syntax
Example

;guardian admin reject @user (master-password)

Reject and delete a member’s pending enrollment. Owner only. The member gets a DM. They can re-enroll if it was a mistake. Only works on unapproved enrollments — use ;guardian admin unenroll to revoke an already-approved one.

;guardian admin reject @wanderer MyMasterPass

Drop wanderer’s pending enrollment.

List pending enrollments

Syntax
Example

;guardian admin pending

List all members with unapproved enrollments. Shows user and submission time. Paginated, 10 per page.

;guardian admin pending

View the queue of members waiting for enrollment approval.

Force-unenroll a user

Syntax
Example

;guardian admin unenroll @user (master-password)

Clear all of a user’s enrollments for this server. Owner only. Use when someone loses access to their TOTP and has no recovery codes.

;guardian admin unenroll @zecroyn MyMasterPass

Clear a user’s enrollments so they can re-enroll.

Temporarily disable

Syntax
Example

;guardian admin temp-disable (minutes) (master-password)

Pause Guardian challenges for 1–60 minutes. Useful during planned maintenance or bulk role changes.

;guardian admin temp-disable 15 MyMasterPass

Pause challenges for 15 minutes.

View audit log

Syntax
Example

;guardian admin audit

View the last 200 Guardian events for this server. Paginated, 10 per page.

;guardian admin audit

View the last 200 Guardian events for this server.

Confirming a challenge

When Guardian intercepts a dangerous action, you receive a DM with a challenge ID. Reply in DM to confirm:

Syntax
Example

;guardian confirm (id) (credential)

Resolve a pending challenge. credential is your TOTP code, recovery code, personal password, or the server master password. DM only — auto-deletes on success.

;guardian confirm pq3xa9wr 482910

Confirm with a TOTP code. Or pass your password / recovery code instead.

If you didn’t initiate the action — just ignore the DM. The change stays reverted automatically after 60 seconds.

Your credential must have been enrolled and approved before the challenge was created. A credential enrolled or approved after the dangerous action fired cannot confirm it — the change stays reverted. This prevents an attacker from enrolling under a compromised account and immediately confirming their own action.

Recovery

Situation	Fix
Lost TOTP device, no recovery codes	Ask server owner: `;guardian admin unenroll @you (master)`, then re-enroll
Lost server master password	Contact raze support — bot owner verifies ownership and resets
Lost `GUARDIAN_KEY`	Generate new key, restart bot, ask enrolled users to re-enroll TOTP. Passwords still work

Get Started

Security

Server Configuration

Economy

Miscellaneous

Integrations

Resources

Guardian

Guardian

Overview

How it works

What counts as dangerous

Credential ladder

Setup

Master password commands

Enrollment

Role locking

Trusted bots

Admin commands

Confirming a challenge

Recovery

​Guardian

​Overview

​How it works

​What counts as dangerous

​Credential ladder

​Setup

​Master password commands

​Enrollment

​Role locking

​Trusted bots

​Admin commands

​Confirming a challenge

​Recovery

Guardian

Overview

How it works

What counts as dangerous

Credential ladder

Setup

Master password commands

Enrollment

Role locking

Trusted bots

Admin commands

Confirming a challenge

Recovery