Access Control

Access Control asks a joining member to complete short Discord interaction checks before Helyx grants the configured access role. It is a local human-interaction check: it can deter basic automated accounts, but it does not detect devices, network risk, alternate accounts or ban evasion.

The default flow uses two different generated challenges and allows three attempts. Eight challenge types are implemented: Quick Sum, Button Sequence, Number Order, Symbol Match, Modal Recall, Server Question, Password Entry and Emoji Entry. Password Entry and Emoji Entry are static gates and are excluded from generated challenge allocation. A server selects one access type: generated Challenges, Password Entry or Emoji Entry.

Permissions and Discord configuration

Access Control requires View Channel, Send Messages, Embed Links, Read Message History and Manage Roles. Kick Members is required only when final failure is configured to kick. Password Entry also requires Manage Messages, Guild Messages and the privileged Message Content intent; its channel health check explicitly requires View Channel, Read Message History and Manage Messages. Emoji Entry may require Add Reactions and the Guild Message Reactions intent.

Helyx must be above the access role and every temporary role it removes. The module adds the access role before removing temporary roles so a partial Discord failure does not remove the member's only access route.

Discord channel permissions are the sole authority for which channels pending members can see. Access Control validates its configured gate, Password Entry, Emoji Entry and staff-review channels, but it does not maintain a second dashboard allowlist of every other visible server channel. Administrators should configure the temporary pre-gate role's Discord permissions directly. The managed Start panel may be absent during the initial activation-and-publish flow, but runtime joins fail closed until its saved message exists. Enabling Server Question likewise requires at least one enabled managed question.

The review-channel audience check rejects @everyone and every configured temporary pre-gate role. The current Discord inspection contract only reports roles explicitly requested by the module and Access Control has no configured staff-role allowlist, so it cannot prove that every other visible role is a staff role; administrators must keep that channel staff-only.

Failure and strict-mode behaviour

Staff review is the default final-failure action. When kick is deliberately selected, Helyx first makes a best-effort attempt to send a neutral direct message explaining that Access Control was not completed. It then rechecks the current decision and kicks as soon as possible; a closed direct-message channel does not prevent the kick. The target is within 30 seconds and there is no deliberate delay.

Authorised Access Control managers may activate temporary strict mode. It lasts 15 minutes by default, can be configured from 5 to 60 minutes, adds one generated challenge without exceeding four, and expires automatically. It does not reduce attempts or enable kicking, Password Entry or Emoji Entry.

Join deadlines and active-check expiry use durable one-shot tasks with exact join generations and session versions. Restarted or duplicate workers cannot enforce an old join or expire a newer check. A failed challenge applies the configured retry cooldown monotonically; passing or an authorised Approve or Retry decision clears it. Account age uses Discord's account-created and joined timestamps, and accepts the exact configured age boundary.

Returning members are restored only when a prior success is retained, restore is enabled, re-verification is disabled, and the current access role is still assignable. Otherwise they enter a fresh pending generation. Adaptive chains add a generated challenge for a prior-failure or young-account signal, while temporary strict mode may add one more, capped at four.

Password Entry and Emoji Entry are single-step access types rather than members of a generated challenge chain. Helyx sends answer-free private resume guidance that identifies the Discord server and gate channel. Closed direct messages never cause user-specific controls or answers to be posted publicly; the member can use the panel or /access-control start to resume the persisted check.

Stored data

The module stores server questions, safe attempt outcomes, member summaries, staff-review decisions, recoverable role transitions and strict-mode activations. Raw Password Entry messages are never retained. Active challenge answers use the shared expiring Helyx session service rather than a module-owned session table. A versioned Privacy Service provider supports bounded access and erasure.

Release state

Version 1.0.0 is private and in Testing. Live Discord validation has not yet been performed. Runtime enforcement rechecks module state, member state, kick permission and role hierarchy immediately before every kick.