---
title: "Show moderators only what the case needs · Agent Wranglers"
url: https://agentwranglers.se/playbook/trust-and-safety/running-trust-and-safety/moderator-access
id: TNS-14
level: Required
risk: data
updated: 2026-10-22
tokens: 1137
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Show moderators only what the case needs

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Running trust and safety](https://agentwranglers.se/playbook/trust-and-safety/running-trust-and-safety.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: TNS-14
- Level: Required
- Chapter: [Running trust and safety](https://agentwranglers.se/playbook/trust-and-safety/running-trust-and-safety.md)
- Rule: Let a moderator open only the reported item, its close context and the author's moderation history. Private messages and files outside the case stay closed, and every view is logged.
- Check: As a moderator, open a case about one message, and the tool shows at most 11 messages of that thread. Request another message ID from the same user through the case API, and the server refuses. Every case view in the last 7 days has an audit event with the moderator and the case ID.
- Risk: Data leaked or lost
- How: A moderation tool that opens any account is a back door to every private message. Build the case view from the case, never from a free search of users. A reported message shows that message and the five before and after it in that thread, not the whole inbox. Show account details, such as email or payment status, only to the roles that need them for that reason. Moderators sign in with separate staff accounts, as [Use separate staff accounts](https://agentwranglers.se/playbook/accounts/support-and-staff-access/staff-accounts.md) requires. Opening anything beyond the case goes through [Impersonate customers only with a reason and a time limit](https://agentwranglers.se/playbook/accounts/support-and-staff-access/impersonation.md). Log each view and action as an [audit event](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events.md). Review a sample of 20 views per moderator each month.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const CONTEXT_MESSAGES = 5;

export async function caseMessages(moderator, caseId) {
  const modCase = await cases.forModerator(moderator.id, caseId);
  if (!modCase || modCase.itemType !== 'message') throw new HttpError(404);
  await audit.record({ actor: moderator.id, action: 'case.view', caseId });
  return messages.around(modCase.itemId, CONTEXT_MESSAGES);
}
```

### Python example

```python
CONTEXT_MESSAGES = 5

def case_messages(moderator, case_id: int) -> list:
    mod_case = cases.for_moderator(moderator.id, case_id)
    if mod_case is None or mod_case.item_type != "message":
        raise HTTPException(404)
    audit.record(actor=moderator.id, action="case.view", case_id=case_id)
    return messages.around(mod_case.item_id, CONTEXT_MESSAGES)
```

## Sources

- [GDPR Articles 5(1)(c) and 25](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html)

## Related rules

- TNS-7 [Report child sexual abuse material and keep the evidence](https://agentwranglers.se/playbook/trust-and-safety/decisions-and-appeals/csam-reports.md) in Trust and safety
- ACC-49 [Use separate staff accounts](https://agentwranglers.se/playbook/accounts/support-and-staff-access/staff-accounts.md) in Accounts and identity
- ACC-51 [Impersonate customers only with a reason and a time limit](https://agentwranglers.se/playbook/accounts/support-and-staff-access/impersonation.md) in Accounts and identity
- CMP-26 [Write an audit event for every sensitive action](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/trust-and-safety/running-trust-and-safety/moderator-access">Agent Wranglers trust and safety playbook</a>`. In code you write, add a comment next to it with the same link.

- Next: [Keep switches that stop an abuse wave](https://agentwranglers.se/playbook/trust-and-safety/running-trust-and-safety/abuse-switches.md)
- [Running trust and safety](https://agentwranglers.se/playbook/trust-and-safety/running-trust-and-safety.md)