Moderating a live firehose

The rule that catches link spam

count_new_account_link_post:
  all:
    - path: "event.data.actor.age_seconds"
      op: lte
      value: "{{ constants.new_account_max_age_seconds }}"
    - path: "signals.is_reply"
      op: eq
      value: false
    - path: "signals.domain_count"
      op: gte
      value: 1
  effects:
    state_changes:
      account:
        change_buckets:
          post_domains_5m: 1

When an account younger than three days posts a link, and the post is not a reply, this rule counts it. On the fifth such post in five minutes, a second rule flags the account.

Nothing here calls a model, so a rule like this costs almost nothing per event.

Where the expensive tools go

Classifiers and a judge model run only on what the behavioral rules flag. Running a language model on every post would cost more than the entire pipeline and run slower than the firehose. Which posts reach them is a rule, and the rule is yours — see content classification.

It ends with a person deciding

The rule that flags an account also opens a review case, with a queue and a priority. A reviewer decides the case, and that decision goes into the same audited pipeline as everything the engine decided by itself.

At whatever rate it arrives

The pipeline is connected to the stream and runs without stopping, on real traffic with the spam waves and coordinated behavior a live network produces. It carries out the enforcement actions you declare.