> For the complete documentation index, see [llms.txt](https://mango-5m.gitbook.io/mango5m-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mango-5m.gitbook.io/mango5m-docs/resources/mango-admin/resource-protection/security-actions.md).

# Security Actions

What happens automatically to whoever stopped it.

{% code title="mango\_watchdogs/config.lua" %}

```lua
Config.SecurityActions = {
    OnUnauthorizedStop = {
        Log         = true,
        NotifyStaff = true,
        Discord     = false,
        Kick        = false,
        Ban         = false,
        BanDays     = 0,          -- 0 = permanent, when Ban is on
        Reason      = 'Tampering with server resources',
    },
    NotifyOnRestart = true,
}
```

{% endcode %}

Logging and telling staff are on. **Kicking and banning are off**, and should stay off until you have watched this run on your server for a while.

## When they can apply at all

Kick and ban only ever fire when **all** of these are true:

* the source is an in-game player the server identified **exactly** — which means the action came through the panel itself
* it was a stop, not an authorised restart
* they are not in `Config.Owners`

A stop from txAdmin, the console or another resource has **nobody to punish**, and none is invented. That is not a limitation to work around; it is the difference between a security tool and one that bans the wrong person.

Both go through the panel's own kick and ban paths, so they land in your ban store and your audit log like any other.

## Escalation

If recovery fails every attempt:

```
[CRITICAL RESOURCE PROTECTION]
Admin resource could not be recovered.
```

Staff are told, the console says so, Discord is mentioned if a role is configured, and the guard stops hammering — then retries quietly every five minutes so that fixing whatever broke brings the panel back without anyone having to remember.

Nothing has to be pressed for it to come back: fix the cause and the next quiet retry starts it, or start it yourself from the console or the panel's Resources page.