# Safety guarantees

Read-only is enforced in layers, not promised in copy:

1. **No Manage Roles at the door.** The install URL requests read + message
   permissions only. Discord itself won't let Freeside touch roles - you can
   verify the permission bits in the invite link.
2. **Runtime mutation guard.** Every Discord write path in the bot goes
   through a guard that refuses role mutations while a guild is in shadow
   mode - defense in depth behind the missing permission.
3. **No Telegram administration.** The Telegram bot observes membership
   events; it holds no ban, restrict, promote, or invite powers.
4. **Verification is read-only.** Members prove wallet ownership with a
   signature - never a transaction, never a seed phrase, and the bot never
   DMs anyone.
5. **Honest data, always.** Unknown members are never fabricated, stale chain
   data never becomes "ineligible", and a partial sample is never presented
   as the whole community. Every number in a report carries its denominator.