Entity Incident Playbook

Entity abuse is the most visible cheating on a FiveM server: raining vehicles, ped armies, explosion spam, props through walls. It's also where panicked moderation does the most damage, because the loudest symptom isn't always the source. This playbook gives staff one consistent way to respond.

Principles

1. One case per burst. Fifty spawned vehicles are one incident with fifty entries, not fifty separate reports. Group by source and time window before anyone reacts.
2. Ownership answers first. For every suspicious entity: which player or resource created it? An entity with no owning resource and a client origin is the classic mod-menu signature.
3. Sequence beats snapshot. What happened in the 60 seconds before the burst — a resource restart, an admin command, a specific player joining? The timeline usually names the culprit; a screenshot rarely does.

The response ladder

Work from least to most disruptive:

• Contain the entities — delete the spawned objects/vehicles/peds. This de-escalates the server without touching any player.
• Contain the source — if a specific client is the origin and the session is still active, isolate or drop that session.
• Punish — only after the case is reviewed. Bans issued mid-panic get overturned, and overturned bans cost trust twice.

What to log per case

Even before Sculk FiveM ships, your staff can practice keeping this record manually — it's the same shape the incident stream produces at rollout:

case: ENT-2026-014
window: 21:42:10 – 21:42:55
entities: 34 vehicles (adder), spawn origin client #113
prior context: player #113 joined 21:39, no resource restarts
containment: entities deleted 21:43, session dropped 21:44
decision: ban (evidence: spawn origin + rate), reviewed by two staff

Explosions deserve their own rule

Explosion events carry a type and a position. Legitimate explosions almost always trace to a game system (vehicle damage, scripted heist); illegitimate ones appear from nowhere, repeat fast, and cluster on player positions. Policy: explosions with no traceable game cause are review-first, repeated untraceable explosions from one origin are containable on sight.

Staff discipline

The playbook only works if every moderator follows the same ladder. Put it in your staff channel, run one tabletop drill on a quiet evening, and agree in advance who has authority to drop sessions versus issue bans. The Staff Review Workflow guide covers the queue side of this.