Abuse Report Triage

Turn an inbound abuse / ToS-violation report into one severity tier and one bounded action, and name the signal that set the tier. A capable model can reason about a report, but by default it is inconsistent: it invents ad-hoc actions ("send a strongly worded message"), punishes disproportionately (a permanent ban for a first mild offense), acts on an unverified accusation, or — the costly failure — handles an imminent-harm or child-safety case in-house as a "warning" instead of escalating it. This skill fixes the output to a fixed ladder and forces the escalation carve-outs.

When to activate

Activate when the request supplies a report of user behavior or content and asks what enforcement action to take. Typical phrasings: "a user reported that…", "how should we action this report", "what do we do about this account".

Do not activate to write the message sent to the offending user, to route a general (non-abuse) support ticket to a queue, or to draft the policy itself.

The action ladder

Reply with exactly one action from this closed set — never invent another:

| Tier | What the report shows | Action | Meaning | |---|---|---|---| | T0 — None | Unsubstantiated, vague, out of scope, or not actually a violation | no-action | Close/needs-review; do not penalize an account on an accusation alone | | T1 — Low | A first, minor violation (one off-topic or promotional post, a single rude remark) | warn | Notify the user; no capability loss | | T2 — Moderate | A clearer or repeated violation (persistent spam, harassing one member, ignoring a prior warning) | restrict | Remove content / limit features; keep the account | | T3 — Serious | Sustained or high-harm violation (targeted harassment campaign, scam/fraud, hateful attack, ban evasion) | suspend or ban | Temporary hold, or permanent removal for severe/repeat cases | | T4 — Critical | An escalation-only category (below) | escalate | Hand to Trust & Safety / Legal; do NOT resolve in-house |

Three rules the default gets wrong

1. A report is not a verdict. A vague or evidence-free accusation ("this user seems like a scammer") is no-action / needs-review, not a punishment. Act on the described behavior, not on the reporter's demand — a reporter asking for a ban does not raise the tier.
2. Proportionality — start low, climb with severity and repetition. A first minor offense is warn, not suspend or ban. ban is reserved for T3 severe or repeat cases; suspend is a temporary hold; restrict keeps the account but removes the offending capability or content. Do not jump the ladder.
3. Mandatory escalation overrides the tier. If ANY escalation-only signal is present, the action is escalate no matter how thin the account's history — never downgrade it to a warning:

• a credible threat of physical harm or violence against a person,
• self-harm or suicide intent,
• child sexual exploitation or any sexual content involving a minor,
• terrorism / violent-extremism organizing,
• a legal or regulatory matter (law-enforcement request, court order, subpoena, or an IP/DMCA claim with legal exposure).

Output

State three things, plainly:

• Action — the one word from the ladder (no-action / warn / restrict / suspend / ban / escalate).
• Tier — T0–T4.
• Signal — the specific fact in the report that set the tier (e.g., "second offense after a prior warning", "names a specific person and a specific threat of harm").

Example — Report: a user posted one link to their own newsletter in an unrelated help thread; no prior reports. → Action: warn · Tier: T1 · Signal: first-time, low-harm self-promotion in the wrong place — proportionate to notify, not to restrict.

Edge cases

• Reporter demands a ban for a minor act. Action tracks the behavior, not the demand — a single rude comment is still warn.
• Escalation signal on a "small" account. A credible threat from an otherwise-clean account is still escalate, not warn — severity of the signal, not the account's tenure, sets T4.
• Multiple violations in one report. Tier on the most severe signal present; an escalation-only signal anywhere makes the whole report escalate.
• Repeat offender. A violation that would be T1 in isolation becomes restrict/suspend when the same user was already warned for it — repetition climbs the ladder.
• Content already removed / user already left. Still record the tier and signal; the action may be no-action, but note why.