GET and PATCH /api/internal/guilds/:guildId/security/join-risk-policy. Select a dedicated quarantine role whose Discord channel permissions implement your verification boundary. A policy can be disabled, exempt up to 20 roles, set account-age and velocity bounds, select up to 50 scope channels, and route an uncertain join to staff review or a verification notice. The account-signal window is configurable from one to sixty minutes; the velocity window cannot exceed it. Pup queries only join timestamps in that window and adds no separate identity profile. Existing join/leave logs, if enabled, keep their independently configured logging retention.
An uncertain join is never automatically kicked or banned. Pup first writes a durable admission incident with the policy revision, correlation ID, role ID, and a bounded raid-correlation key, then assigns only the configured quarantine role. The member receives a private notice explaining that the result is uncertain and how to request correction. Only authorized server configurators can read or restore an admission; an authorized restoration calls POST /api/internal/guilds/:guildId/security/join-admissions/:id/restore and removes only the exact role recorded by Pup for that incident, never a newly configured or unrelated member role.
Manual quarantine
/quarantine uses the same reviewed quarantine role for an authorized, current member. Before use, Protection → Join admission can show a read-only quarantine access preview: the exact modeled role, channels, text, voice, thread, and application-command communication paths, plus the limits of that model. Pup records a moderation case and the exact role it queued; /unquarantine can remove only that recorded role, never a later policy choice or another staff-managed role. Quarantine is indefinite until that explicit staff restoration. A normal /unrestrict never adopts, removes, or widens a quarantine.
Dashboard → Moderation → Cases shows the queued role, current provider outcome, and whether an
explicit restoration is confirmed. An uncertain or failed operation does not claim that access
changed. To replace an active quarantine, restore its recorded role first and then create a new
reviewed quarantine; changing the join-admission policy never substitutes a role on an active case.
Before enabling the guard, verify the bot has the Guild Members intent and test the configured policy with a non-production server. A successful local or automated test proves behavior at that revision; it does not prove current deployment or Discord delivery.