Deny by default
An actor can take only the actions allowed for their role and the content's current state. Browser role selection is never sufficient authorization.
Give local voices a fair process.
A responsible community needs more than a Post button. Walk through a fictional Signal from private draft to review, response, appeal and withdrawal. See exactly which action is allowed—and why.
i
Training simulation — not a live moderation dashboard.
All three stories are invented. Actor selectors do not authenticate you or confer real permissions. No review is saved or sent to the server. “Approved preview” means approved only inside this tab; nothing appears in a public Orbit feed.
FICTIONAL CASES3No real people or businesses
REAL PUBLIC SIGNALS0Publishing remains blocked
ACTUAL REVIEWERS0No staffed moderation queue
APPEAL SAFEGUARD1Independent-review design
WORKFLOW SANDBOX
One Signal. Many safeguards.
Select an invented scenario, act as different mock roles, and watch the audit trail change. Invalid transitions are blocked.
01 Select a fictional Signal
This picker is for teaching, not identity verification. Production permissions must be enforced on every server request.
Only actions allowed for this state and role will appear.
No action applied yet.
SIMULATED LIFECYCLE
PRIVATE DRAFTSelect a fictional case
Not a public post, alert or authoritative finding
Decision history
0 events- This Signal has not entered review. Choose Submit as the author to begin.
A reviewer should never be the whole system.
Facts before labels
Disputed experiences may be discussed carefully. Categorical allegations, identifying details and unsupported certainty require review and possible changes.
Reasons and history
Every decision needs a policy reason, a version and an append-only audit event. No silent publication or covert removal.
Independent appeals
A rejected author can ask another reviewer to assess the decision. Reopening goes back to review—not straight to publication.