Show moderators only what the case needs

How to do it

A moderation tool that opens any account is a back door to every private message. Build the case view from the case, never from a free search of users. A reported message shows that message and the five before and after it in that thread, not the whole inbox. Show account details, such as email or payment status, only to the roles that need them for that reason. Moderators sign in with separate staff accounts, as Use separate staff accounts requires. Opening anything beyond the case goes through Impersonate customers only with a reason and a time limit. Log each view and action as an audit event. Review a sample of 20 views per moderator each month.

Examples

JavaScript example

const CONTEXT_MESSAGES = 5;

export async function caseMessages(moderator, caseId) {
  const modCase = await cases.forModerator(moderator.id, caseId);
  if (!modCase || modCase.itemType !== 'message') throw new HttpError(404);
  await audit.record({ actor: moderator.id, action: 'case.view', caseId });
  return messages.around(modCase.itemId, CONTEXT_MESSAGES);
}

Python example

CONTEXT_MESSAGES = 5

def case_messages(moderator, case_id: int) -> list:
    mod_case = cases.for_moderator(moderator.id, case_id)
    if mod_case is None or mod_case.item_type != "message":
        raise HTTPException(404)
    audit.record(actor=moderator.id, action="case.view", case_id=case_id)
    return messages.around(mod_case.item_id, CONTEXT_MESSAGES)

How to check

As a moderator, open a case about one message, and the tool shows at most 11 messages of that thread. Request another message ID from the same user through the case API, and the server refuses. Every case view in the last 7 days has an audit event with the moderator and the case ID.

Sources

• GDPR Articles 5(1)(c) and 25
• OWASP Authorization Cheat Sheet

Related rules

• TNS-7 Report child sexual abuse material and keep the evidence in Trust and safety
• ACC-49 Use separate staff accounts in Accounts and identity
• ACC-51 Impersonate customers only with a reason and a time limit in Accounts and identity
• CMP-26 Write an audit event for every sensitive action in Compliance and governance