Abuse Report Triage

Abuse Report Triage

Turn an inbound abuse / ToS-violation report into one severity tier and one bounded action, and name the signal that set the tier. A capable model can reason about a report, but by default it is inconsistent: it invents ad-hoc actions ("send a strongly worded message"), punishes disproportionately (a permanent ban for a first mild offense), acts on an unverified accusation, or — the costly failure — handles an imminent-harm or child-safety case in-house as a "warning" instead of escalating it. This skill fixes the output to a fixed ladder and forces the escalation carve-outs.

When to activate

Activate when the request supplies a report of user behavior or content and asks what enforcement action to take. Typical phrasings: "a user reported that…", "how should we action this report", "what do we do about this account".

Do not activate to write the message sent to the offending user, to route a general (non-abuse) support ticket to a queue, or to draft the policy itself.

The action ladder

Reply with exactly one action from this closed set — never invent another:

Three rules the default gets wrong

1. A report is not a verdict. A vague or evidence-free accusation ("this user seems like a scammer") is no-action / needs-review, not a punishment. Act on the described behavior, not on the reporter's demand — a reporter asking for a ban does not raise the tier.
2. Proportionality — start low, climb with severity and repetition. A first minor offense is warn, not suspend or ban. ban is reserved for T3 severe or repeat cases; suspend is a temporary hold; restrict keeps the account but removes the offending capability or content. Do not jump the ladder.
3. Mandatory escalation overrides the tier. If ANY escalation-only signal is present, the action is escalate no matter how thin the account's history — never downgrade it to a warning:
   • a credible threat of physical harm or violence against a person,
   • self-harm or suicide intent,
   • child sexual exploitation or any sexual content involving a minor,
   • terrorism / violent-extremism organizing,
   • a legal or regulatory matter (law-enforcement request, court order, subpoena, or an IP/DMCA claim with legal exposure).

Output

State three things, plainly:

• Action — the one word from the ladder (no-action / warn / restrict / suspend / ban / escalate).
• Tier — T0–T4.
• Signal — the specific fact in the report that set the tier (e.g., "second offense after a prior warning", "names a specific person and a specific threat of harm").