Moderation

Everything that arrives waits for a person. This page is about that person's tools.

Inbox is the queue: newest first, filterable by state, kind, rating and tags.

States

stateDiagram-v2
    [*] --> pending: arrives
    pending --> approved: you approve
    pending --> rejected: you reject
    pending --> spam: you mark as spam
    approved --> pending: restore
    rejected --> pending: restore
    approved --> withdrawn: consent withdrawn

State	Meaning
Pending	Arrived, nobody has looked
Approved	A person approved it. Publishable, if consent allows
Rejected	Not wanted. Kept, not deleted
Spam	Rejected, and counted as abuse
Draft	A video reservation exists but the visitor has not submitted yet

Rejecting keeps the item. You can restore it later, and you can read it while deciding — a rejection is a decision about publishing, not a deletion.

The invariants

Three rules are structural rather than settings. None of them can be switched off, which is the point:

1. No automatic publication. There is no configuration that approves things for you. AI moderation and the CAPTCHA score produce signals; approval is an action a person takes.
2. Approval cannot be done by a machine. The approval path structurally refuses AI and system actors. A bot cannot approve on your behalf even with a token that carries moderate:submissions.
3. Approved is not the same as displayable. Display also needs the person's consent. Both facts are stored, separately, and the public queries require both.

The audit trail

Every transition records who did it, when, and from what state. Bulk actions record one entry per item, not one for the batch.

State changes are compare-and-set: approving something already approved is not an error and does not fire a second webhook, so a double-click or a retried API call is harmless.

AI moderation

Optional, per project, and off by default. When it is on, incoming text is classified and the inbox shows a badge — spam, abuse, a likely duplicate.

It is triage. It reorders your queue; it does not empty it.

Switching it on discloses something to your visitors

AI moderation sends submitted text to a third-party model. That is a disclosure your privacy notice should carry, which is why the setting says so and why it starts off.

Video

A pending video is private. Moderators watch it through a short-lived signed URL; no public URL exists until approval promotes the file. Reject it, or the person withdraws consent, and the object is deleted and the CDN edge purged.