The updating of RBAC using updateRBAC utility function should happen regardless of the violation or normal events. This will ensure the monitor is keeping track of the runtime data correctly.
I think the following line is the suitable place to add it (before serve):
https://github.com/mojtaba-eshghie/CLawK/blob/43d809942a90c2beb851579a473cba379ef42eac/server/monitor/dcrCaller.js#L65