Media · Circo

Video moderation that fails closed

A media admission pipeline that probes cheaply, gates on spec, classifies with a model, and always returns one predictable result, rejecting what it cannot inspect.

Architect · Engineering lead

The problem

Model-assisted moderation is tempting to describe as "AI decides". In practice the interesting engineering is everything around the model: what happens when the file is corrupt, when the provider times out, when the model refuses. Downstream services need one answer they can trust.

My role

I designed the contract and the fail-closed rule and built the service with my team. It screens every upload on Circo in production.

How it works

Cheap checks first. The file is probed for its technical facts, then held against a spec gate: duration, resolution, frame rate, audio and size. A spec failure is rejected before any paid model call.
Then classify. Files that pass are classified by a multimodal AI model, and every result carries a confidence.
One contract. Every result has the same keys: a decision of APPROVED or REJECTED and a reason code of PASSED, SAFETY_VIOLATION, SPEC_VIOLATION or PROCESSING_ERROR. A stage that did not run says evaluated: false rather than disappearing.
Fail closed, retry first. If content cannot be inspected it is rejected, because uninspected content cannot be cleared. Transient provider errors are retried through a dead-letter queue before any terminal verdict.
Never starve the main line. Moderation runs on its own lane, so slow analysis cannot back up publishing.

In the Video Factory, mark an upload out of spec or unreadable: it is rejected, nothing is packaged, and the result records that the safety pass was not evaluated.

System

Adaptive streaming and the transcoding ladder

Every upload becomes a ladder of renditions, packaged once for HLS and DASH and served from the edge, so every phone gets the best stream its connection can hold. Live in production.

TranscodingABRCMAF

System

Multi-DRM protection and entitlement-gated playback

Encrypt once, license per viewer: paid creator video protected across every major DRM system, where the licence decision is a business rule about who has paid. Live in production.

DRMEntitlementHLS

Video moderation that fails closed

The problem

My role

How it works

Related systems

Adaptive streaming and the transcoding ladder

Multi-DRM protection and entitlement-gated playback

The problem

My role

How it works