Moderation is consistent and fair

Without a moderation log, enforcement becomes arbitrary and unauditable. ISO 27001:2022 A.5.35 requires that organizations document accountability measures — a moderation log is the primary accountability artifact for content enforcement. Without it, there is no way to detect bias (one moderator removing content the others would approve), no way to identify moderator error rates, and no defensible record if a user challenges a moderation decision in court or through a DSA complaint. Platforms with no moderation audit trail also cannot train new moderators, because there is no historical record of what decisions were made and why.

Create a moderation_logs table and write a record for every enforcement action. Add the logging helper to src/lib/moderationLog.ts:

export async function logModerationAction(params: {
  action: 'remove' | 'approve' | 'ban' | 'warn' | 'restore';
  contentId: string;
  reason: string;
  moderatorId: string;
  metadata?: Record<string, unknown>;
}) {
  await db.moderationLogs.create({
    ...params,
    createdAt: new Date(),
  });
}

A log entry must capture at minimum: action, reason, moderatorId, and timestamp. A log that records only the action but omits the reason does not satisfy this check. Call logModerationAction from every moderation endpoint before returning a response.