# 2.1 caller group

_Peios / Using Peios / Events / Groups_

> The identity LCS records on an audited operation.

- **Group:** `caller`
- **Defined in:** `lcs.evman`

The identity LCS records on an audited operation. A deliberate subset of
`subject` — the token's durable GUIDs ride in the event header, and the
group SIDs and PIP state that KACS records are absent here.

**That absence is a gap rather than a design.** Access to a registry key is
granted through a group as often as to a user SID directly, so an LCS
record cannot answer "which membership let this through" where the
equivalent KACS record can. The two subsystems reached the bound on what to
serialise independently and landed in different places.

## 2.1.1 Fields

| Field | Type | Meaning |
|---|---|---|
| [`subject.token.sid`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.sid) | `bin.sid` | The user SID of the effective token the operation ran under. |
| [`subject.token.integrity`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.integrity) | `uint.integrity` | The integrity RID of the effective token. |
| [`subject.token.id`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.id) | `uint.luid` | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
| [`subject.token.auth-id`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.auth-id) | `uint.luid` | The LUID of the logon session the effective token belongs to. |
| [`subject.token.type`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.type) | `str.enum` | Whether the effective token is a primary token or an impersonation token. |
| [`subject.token.impersonation`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.impersonation) | `uint.enum` | The impersonation level of the effective token. |

## 2.1.2 Carried by

- [`lcs.audit.backup.ended`](/peios/using-peios/events/lcs/lcs-audit-backup-ended.md)
- [`lcs.audit.backup.started`](/peios/using-peios/events/lcs/lcs-audit-backup-started.md)
- [`lcs.audit.key.created`](/peios/using-peios/events/lcs/lcs-audit-key-created.md)
- [`lcs.audit.key.deleted`](/peios/using-peios/events/lcs/lcs-audit-key-deleted.md)
- [`lcs.audit.key.descriptor.changed`](/peios/using-peios/events/lcs/lcs-audit-key-descriptor-changed.md)
- [`lcs.audit.key.hidden`](/peios/using-peios/events/lcs/lcs-audit-key-hidden.md)
- [`lcs.audit.key.opened`](/peios/using-peios/events/lcs/lcs-audit-key-opened.md)
- [`lcs.audit.key.tombstoned`](/peios/using-peios/events/lcs/lcs-audit-key-tombstoned.md)
- [`lcs.audit.restore.ended`](/peios/using-peios/events/lcs/lcs-audit-restore-ended.md)
- [`lcs.audit.restore.started`](/peios/using-peios/events/lcs/lcs-audit-restore-started.md)
- [`lcs.audit.transaction.committed`](/peios/using-peios/events/lcs/lcs-audit-transaction-committed.md)
- [`lcs.audit.value.deleted`](/peios/using-peios/events/lcs/lcs-audit-value-deleted.md)
- [`lcs.audit.value.set`](/peios/using-peios/events/lcs/lcs-audit-value-set.md)

*Generated from `lcs.evman` by `pkm/tools/gen-events-book.py`. Edit the fragment, not this page.*