# Service Actions

Task-oriented recipes. Each section assumes you already have `splam` installed and running. See the [Tutorial](tutorial-getting-started.md) if not.


# Require & check reasons before service actions

The **Reason** field on the **Actions** tab is required for Start/Stop/ Restart. An empty reason blocks the action and shows `[rejected: reason required]` in the **Status** tab.

No `systemctl` command is run, though the rejected attempt is still recorded in the audit trail. This is enforced server-side per session, not just in the UI.


# Restrict actions to admin accounts

The **Actions** tab only appears for accounts with the `admin` role; an `auditor` account gets the read-only tabs and a note in the sidebar. This ensures that an action cannot be performed without a valid reason, preventing unauthorized or arbitrary service modifications.

The check is repeated server-side before any `systemctl` command runs, so an action submitted outside the UI is rejected with `rejected: role not permitted` and recorded in the audit trail.

See [Manage Logins](01.01-how-to-logins.md) for assigning roles.