System Architecture Overview

# Architectural Philosophy

R Anti-Cheat operates on a Single Authority, Zero-Trust Paradigm. In Roblox, the network replication layer grants physics ownership of the local player character to the client. This design optimizes responsiveness for legitimate players, but makes it trivial for exploit scripts to overwrite position, velocity, and animation states.

RAC does not attempt to restrict memory or inject client-side security hooks that can be bypassed. Instead, RAC runs 100% on the server, treating the client as an untrusted physics emitter whose incoming state must pass geometric, physical, and temporal validation before being accepted.

---

# High-Level Component Topology

┌─────────────────────────────────────────────────────────────────────────────────┐
│                           SERVER-SIDE SUBSYSTEMS                                │
│                                                                                 │
│   ┌───────────────────────────────────┐    Telemetry    ┌───────────────────┐   │
│   │        15 Detection Engines       │────────────────►│ Heuristics Engine │   │
│   │ (Movement, Combat, State, Network)│                 │ (AI Correlation)  │   │
│   └─────────────────┬─────────────────┘                 └─────────┬─────────┘   │
│                     │ Rollback / Clamp                            │             │
│                     ▼                                             ▼ Confidence  │
│   ┌───────────────────────────────────┐                 ┌───────────────────┐   │
│   │         Spatial Validator         │                 │ PunishmentManager │   │
│   │     (Raycasts, Delta Positions)   │                 │ (Kick, Ban, Mute) │   │
│   └───────────────────────────────────┘                 └─────────┬─────────┘   │
│                                                                   │             │
└───────────────────────────────────┬───────────────────────────────┼─────────────┘
                                    │ Cross-Server Sync             │ Webhook
                                    ▼                               ▼
                         [ MessagingService ]              [ Discord Webhooks ]

---

# Core Server Subsystems

# 1. Engine.luau

The central orchestration singleton. Engine coordinates initialization, attaches detectors to the RunService.Heartbeat loop, creates spatial bounding boxes, and exposes the public server API for external game scripts.

# 2. DetectionEngine.luau

The registry and coordinator for all 15 detection modules. Every frame or event tick:

• Manages per-player violation counters and cooldown decay.
• Normalizes telemetry across disparate detectors into unified ViolationReport structs.
• Routes violation reports directly into HeuristicsEngine.

# 3. HeuristicsEngine.luau

The AI and anomaly evaluation engine. Implemented in pure Luau, this module evaluates incoming reports against known exploit fingerprints (e.g., speed + combat reach + remote burst) while factoring in player network latency and server frame-time variance ($\Delta t$).

# 4. PunishmentManager.luau

The centralized enforcement authority. Executes warnings, position rollbacks, kicks, temporary bans, and permanent bans. Synchronizes punishments with DataStoreService and broadcasts ban events across the entire experience cluster via MessagingService.

# 5. RBACManager.luau

Role-Based Access Control enforcing hierarchical permissions (Viewer, Moderator, Admin, SuperAdmin, Owner). Controls access to in-game moderation tools and sensitive server remotes.

# 6. StorageManager.luau

Abstraction layer over Roblox DataStoreService and MemoryStoreService. Handles serialization, exponential backoff retries, and automatic failover to FallbackStore when running in Studio without API keys.

---

# Next Steps

• Trace the lifecycle of a detection in the Execution Lifecycle Guide.
• Learn about the Client-Server Trust Model.