Moderating a live firehose

The rule that catches link spam

count_new_account_link_post:
  all:
    - path: "event.data.actor.age_seconds"
      op: lte
      value: "{{ constants.new_account_max_age_seconds }}"
    - path: "signals.is_reply"
      op: eq
      value: false
    - path: "signals.domain_count"
      op: gte
      value: 1
  effects:
    state_changes:
      account:
        change_buckets:
          post_domains_5m: 1

Account younger than three days, posting rather than replying, with a link in the post. Count it. On the fifth such post in five minutes, flag the account.

Nothing here calls a model. Age, whether it is a reply, link count, a bucket and a threshold. That is most of moderation at this scale, and it costs almost nothing per event.

Where the expensive tools go

Classifiers and a judge run only on what the behavioral rules flag. Running a language model on every post would cost more than the entire pipeline and run slower than the firehose. Which posts reach them is a rule, and the rule is yours — see content classification.

It ends with a person deciding

A flagged item opens a review case with a queue and a priority. A reviewer decides it, and that decision goes into the same audited pipeline as everything the engine decided by itself.

At whatever rate it arrives

The pipeline points at the stream and stays running. Real traffic, with the spam waves and coordinated behavior a live network produces.

It opens the cases your rules call for, and carries out the enforcement actions you declare.