Upload Moderation Boundaries: Text and Image Signals for Support Photo OCR

Moderation boundaries for uploaded content need to consider both text and image signals, with separate evaluations for each. Text checks can analyze words, filenames, and captions, but cannot guarantee pixel safety or visual meaning. Image analysis should be treated as a distinct signal, with a capacity planning model based on intake pipelines rather than a single moderation call.

The system should model this with a deliberately bounded load, such as 10 million photos per month, a 6 MB size limit, one normalized derivative, and one retry budget. This forces the team to account for retained bytes, temporary bytes, cache keys, and duplicate work, without predicting real workload needs.

A key principle is that text verification alone cannot clear the image channel. If an OCR worker is slow while object ingestion remains healthy, captions may pass text rules while queued photos accumulate, causing clients to retry unseen requests. If the system equates caption acceptance with photo acceptance, it can silently convert an unavailable image signal into approval.

Separate evidence states - pass, fail, and unknown - should be used for each required signal, with unknown covering timeouts, decode rejection, exhausted retries, or any condition without a policy verdict. Policies can then combine these states, rejecting or quarantining items with known failures, allowing successful required passes, and routing any unknowns to a bounded review queue or pending status.