Skip to main content
Bodycam rechecks recording and evidence actions on the server. Grant only the actions each role needs.

​
Example roles

Assign player identifiers to these groups using your server’s existing ACE structure. If supervisors or administrators also need to review their own evidence through a different role layout, grant review.own as well or configure group inheritance.

​
Framework job grades

When Events Core is configured for a supported framework, on-duty jobs can authorize Bodycam actions through eventsBodycam/config/permissions.lua:
  • JobGrades controls standard actions such as use, recording, own or departmental review, and annotations.
  • ElevatedJobGrades controls review-all, classification, archive, lock, deletion, and administrative actions.
The shipped jobs are police, sheriff, ambulance, and fire. Their standard minimum grade is 0 and elevated minimum grade is 2. Change these values to match your framework’s grade numbering and department policy. The wearer policy can also require an inventory item or EUP component. Passing those checks does not replace action permissions such as bodycam.record unless EligibilityMode = 'any' is intentionally configured for base wearer eligibility; recording and evidence actions are still authorized separately.

​
Trusted integrations

Leave Config.Permissions.TrustedResources empty unless a reviewed server integration explicitly needs the one-argument GetBodycamRecording(recordingId) lookup. Adding a resource grants that resource a trusted server-side evidence read path; it does not grant players additional permissions. Player-initiated requests should always use the player-scoped lookup so Bodycam can apply that player’s evidence access.

​
Least-privilege guidance

  • Give normal wearers review.own instead of review.all.
  • Give review.department only to roles that should see coworkers’ evidence.
  • Restrict classify, archive, lock, and delete to supervisors or evidence custodians.
  • Keep bodycam.delete separate from normal recording and review roles.
  • Treat TrustedResources as a server integration allowlist, not a convenience setting.
  • Test permissions with a non-administrator account before launch.