> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kansato.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Moderation workflow

> Case statuses, severity routing, and how work moves through Whistle.

## Case lifecycle

Cases use these API/database statuses:

| Status      | Meaning                                                                                                                    |
| ----------- | -------------------------------------------------------------------------------------------------------------------------- |
| `OPEN`      | Ingested; not yet in active review (or reopened after resolve).                                                            |
| `TRIAGED`   | Risk scored and routed to the appropriate queue bucket.                                                                    |
| `IN_REVIEW` | Actively being worked—for example after AI enrichment crosses a confidence threshold, escalation, or moderator assignment. |
| `RESOLVED`  | Closed with a resolution (content or account action recorded).                                                             |
| `DISMISSED` | Closed without violation (false positive, duplicate, out of scope, etc.).                                                  |
| `APPEALED`  | Under appeal review after a user contested the decision.                                                                   |
| `CLOSED`    | Terminal closed state where your workflow uses it (for example after final disposition).                                   |

## Severity routing

Each case is sorted into one of three buckets at intake:

| Bucket        | Criteria                                    | Routing                                                      |
| ------------- | ------------------------------------------- | ------------------------------------------------------------ |
| **Emergency** | Imminent self-harm, CSAM, credible violence | Auto-routes to the **escalation queue** for immediate action |
| **High**      | Harassment, hate speech, fraud, scams       | Generalist queue with elevated priority                      |
| **Normal**    | Spam, low-severity content                  | Generalist queue, standard priority                          |

Severity is determined by AI classification and report reason hints configured in **Settings → Moderation**.

## Cases as the unit of work

Moderation work is tracked **per case** (the canonical envelope). A single case can link duplicate reports, related content, and account-behavior signals. Each case has its own status, assignment, tags, and history.

## Automated actions

Two automated actions run at intake for high-confidence matches:

| Action         | Trigger                                          | Behavior                                           |
| -------------- | ------------------------------------------------ | -------------------------------------------------- |
| **Hash block** | Known-content hash match (CSAM, terrorism, etc.) | Auto-blocks content, creates case with audit trail |
| **Spam rule**  | Deterministic spam/scam pattern match            | Auto-dismisses, logs with precision metrics        |

Everything else lands in a queue for human review.

## Reviewer outcomes

Moderators choose from three primary actions:

| Outcome                   | When to use                                                          |
| ------------------------- | -------------------------------------------------------------------- |
| **No action**             | False positive, duplicate, out of scope, not actionable              |
| **Remove content**        | Content violates policy — triggers takedown + notification           |
| **Temp restrict account** | Account-level action (ban, suspend, warn) with configurable duration |

Escalation to the **escalation queue** is available as a secondary action for sensitive categories (child safety, terrorism, imminent harm, unclear legal issues).

## Escalation queue

The escalation queue is a dedicated view for time-sensitive and legally-sensitive cases:

| Category                       | Handling                           |
| ------------------------------ | ---------------------------------- |
| Child safety                   | Specialist review, NCMEC reporting |
| Terrorism / violent extremism  | Specialist review, law enforcement |
| Imminent self-harm or violence | Emergency on-call response         |
| Unclear legal jurisdiction     | Policy lead review                 |

## Notices

Every decision generates a structured notice to the affected user:

* What action was taken
* Which policy or law was involved
* Whether automated means were used
* Duration of the action (if temporary)
* How to appeal

## Appeals

Users can appeal enforcement actions within a defined window:

1. User submits an appeal with their explanation and any new context.
2. A fresh reviewer (not the original decision-maker) reviews the case.
3. The reviewer upholds, reverses, or modifies the action.
4. Reversals automatically roll back the enforcement action and restore content.

## Queue

The moderation queue reads organization cases (for example `GET /api/v1/organizations/{orgSlug}/cases`). Common filters:

* **Project** — limit to one integration surface.
* **Open vs done** — active cases are typically `OPEN`, `TRIAGED`, or `IN_REVIEW`.
* **Severity bucket** — Emergency, High, or Normal.
* **Queue type** — General or Escalation.

Exact fields and filters are in the **API reference** and OpenAPI spec.