RBAC Audit Log
Every RBAC permission check is logged with complete context. Use audit logs for compliance, troubleshooting permission issues, and security analysis.
What Gets Logged?
Every time a user attempts an action, SYNTHET logs the permission decision:
Request Information
Who: User ID and username
What: Capability being requested (e.g., "moderation.ban")
When: Exact timestamp with millisecond precision
Decision Information
Result: ALLOW or DENY
Reason Code: Why the decision was made
Decision Path: Which grants were evaluated, in priority order
Context Information
Actor: User's roles, whether they're admin, whether owner
Resource: What resource the action targets (channel, category, guild)
Source: WEB (dashboard), BOT (command), or API (integration)
Reason Codes
Each log entry includes a reason code explaining how the decision was reached:
RBAC_GRANT_ALLOW
An ALLOW grant in a role matched the capability
RBAC_GRANT_DENY
A DENY grant in a role matched the capability
OVERRIDE_ALLOW
User had an ALLOW override for the capability
OVERRIDE_DENY
User had a DENY override for the capability
ADMIN_BYPASS
User is admin and admin bypass is enabled
BREAK_GLASS
Break-glass emergency mode is active
DEFAULT_PUBLIC
No explicit grant found, capability is defaultPublic=true
NO_GRANT
No explicit grant found, capability is defaultPublic=false
DISCORD_GATE_DENIED
Discord gate is required and user lacks Discord permission
Accessing Audit Logs
View audit logs from the RBAC Dashboard:
Audit Tab
RBAC Dashboard → Audit tab. Shows all permission decisions from most recent to oldest.
Log Entry View
Each log entry displays:
- •Username of requester
- •Capability requested
- •Decision (ALLOW/DENY badge, color-coded)
- •Reason code
- •Timestamp (human-readable, e.g., "2 minutes ago")
Expand for Details
Click any log entry to expand and see full details: user ID, all roles, admin status, scope, source, complete decision path with all evaluated grants.
Searching & Filtering Logs
Powerful search and filter tools to find specific events:
Filter by User
Searchable dropdown to select a user. Shows logs for all permission checks by that user. Useful for investigating a specific user's activity.
Filter by Capability
Searchable dropdown to select a capability. Shows all permission checks for that capability across all users. Useful for security analysis.
Filter by Decision
Checkboxes to show ALLOW, DENY, or both. Useful for finding denied access attempts or successful operations.
Filter by Reason Code
Multi-select to show logs from specific reason codes. For example, show only "ADMIN_BYPASS" logs to audit admin activity.
Date Range Filter
Calendar picker to select start and end dates. Show logs from a specific time period (e.g., last 24 hours, last week, custom range).
Advanced Search
Combine multiple filters. For example: "All DENY decisions for 'moderation.ban' by users in role 'Moderator' in the last 7 days".
Audit Log Retention
Logs are retained based on your policy settings:
Retention Duration
Configured in Policy Setup (default: 90 days). Logs older than this are automatically deleted.
Adjust: Go to RBAC Dashboard → Setup tab → Audit Retention Days setting
Retention Options
Common retention periods:
- •30 days: Short term, light storage footprint
- •90 days (default): Good balance for most servers
- •180 days: Longer history for large servers
- •365 days: Full-year retention for compliance
Compliance Tip: For regulated communities (financial, healthcare, legal), use 365-day retention and export logs regularly for archival.
Export & External Analysis
Export logs for external analysis, compliance reporting, and long-term archival:
Export to CSV
Export current view (filtered or all) to CSV. Import into Excel, Google Sheets, or analysis tools for custom reports.
Export to JSON
Export in machine-readable JSON format. Includes all fields with full detail. Useful for programmatic analysis or archival.
Scheduled Reports
Set up automatic weekly/monthly audit log exports. Reports are emailed to admins for compliance documentation.
Tip: Export logs monthly and store in your compliance/audit folder for regulatory requirements.
Using Logs for Troubleshooting
Audit logs are invaluable for diagnosing permission issues:
❓"Why can't user X do action Y?"
Search audit logs for that user and capability. Look at the decision path to see which grants were evaluated and why decision was DENY.
❓"Who has admin access recently?"
Filter logs for reason code "ADMIN_BYPASS" over last 24 hours. Shows all actions where admin bypass was used.
❓"Which users tried to ban people?"
Filter logs for capability "moderation.ban". View results (both ALLOW and DENY) to see all ban attempts and who made them.
❓"Is my RBAC policy correct?"
Review logs over a few days. Legitimate users should have mostly ALLOW decisions. Unexpected DENY patterns indicate misconfigured grants.
❓"Did break-glass mode get used?"
Filter logs for reason code "BREAK_GLASS". Shows all actions taken during emergency mode activation.
Security Analysis with Audit Logs
Use audit logs to detect potential security issues:
Excessive Denied Access
Large number of DENY decisions for a user suggests either misconfigured grants or user trying actions they shouldn't. Investigate.
Unusual Capability Usage
If a user normally never uses "moderation.ban" but suddenly uses it frequently, account may be compromised. Audit trail shows when pattern changed.
Break-Glass Usage
Break-glass mode should rarely be used. Frequent activations indicate recurring configuration issues. Fix underlying policy instead.
Override Abuse
Monitor if users frequently receive temporary overrides. Could indicate policy gaps where regular grants would be better.
Audit Log Best Practices
- 1.Review logs weekly: Check for unusual patterns or misconfigured grants
- 2.Export monthly: Archive logs for compliance and historical reference
- 3.Monitor high-risk actions: Track CRITICAL capability usage closely
- 4.Set adequate retention: Keep logs long enough for your compliance requirements
- 5.Use for policy tuning: Audit logs reveal what grants actually needed vs assumed
- 6.Document patterns: Keep notes on expected usage patterns for quick anomaly detection
- 7.Automate alerts: Set up webhooks or integrations to alert on suspicious patterns