Serving and Degradation

In one line: almost nothing has to block publication, and deciding what does is the main serving decision in the whole design.

Before or after publication

Every check sits on one side of this line, and the placement decides the architecture.

Synchronous, before the post is visible. Adds latency to publishing, which users notice. Justified only where the content must never be seen, even briefly.

Asynchronous, after publication. No user-visible latency, unlimited compute budget, and a window in which violating content is live.

The reach argument from the first lesson decides most cases: for the overwhelming majority of posts, early views are so few that an asynchronous decision within seconds costs almost nothing.

What belongs in the synchronous path: the known-bad hash match, because it is sub-millisecond and near-certain and the categories it catches are the ones that must never be visible. Cheap text checks on obvious violations. Account-state checks — a banned or restricted account should not be posting at all.

Everything else is asynchronous: full multimodal classification, video analysis, network features, human queueing. None of it fits a publication path and none of it needs to.

The exception

Some categories genuinely cannot tolerate any exposure window. Child safety content, terrorist material, non-consensual intimate imagery — for these, "visible for four seconds" is not acceptable.

The resolution is to hold only those synchronously, using only checks fast enough for the path — which is the hash match, and increasingly a fast classifier tier for the highest-severity categories.

That produces a per-category publication policy rather than a global one: most content publishes immediately and is checked after; a small set waits. Stating that split explicitly is the answer, because both "everything blocks" and "nothing blocks" are wrong.

The asynchronous pipeline

Where the real work happens, and it is a priority queue rather than a queue.

New posts enter with a priority derived from predicted reach and the author's history. Workers pull in priority order and run the full pipeline. Results update enforcement state, which propagates to serving.

Three properties worth naming.

It must be re-entrant. The same post is processed multiple times — at creation, when velocity crosses a threshold, when policy changes, when a report arrives. That is a feature, not a retry, and the pipeline has to be designed for it rather than assuming one pass.

Propagation has to be fast. A removal decision is worthless until the content stops being served, and on a platform with aggressive caching and fan-out, that is a distributed invalidation problem. The end-to-end metric is time from decision to last impression, not time to decision.

Backlog is a risk, not just a delay. A queue running hours behind means violating content is live for hours. Depth and age are operational alarms, not dashboard curiosities.

Load shedding

Volume spikes — a major event, a coordinated campaign, a viral moment — and capacity does not. What gives?

The wrong answer is uniform degradation: sample a fraction of content and skip the rest. It drops severe content at the same rate as trivial content.

The right answer follows the priority function. Under load, spend the remaining capacity on the highest severity times reach, and let the tail go unprocessed or receive only cheap checks. Concretely:

Never shed the hash match. It is nearly free and covers the worst categories.

Shed the expensive tiers first, and for low-reach content only. Dense video analysis on a post with nine views is the first thing to drop.

Preserve capacity for spreading content. Content whose velocity is rising is exactly what must not be skipped, and it is a small fraction of volume.

Queue rather than drop, where possible. A delayed check is better than none, provided the queue does not grow without bound — which requires the shedding to be real rather than deferred indefinitely.

Failure modes

Three, with different answers.

A classifier is unavailable. Fall back to the remaining signals and mark the content as under-assessed, so it can be re-processed rather than silently treated as clear. The failure that matters is a model returning a default score that looks like a confident pass.

The hash database is unavailable. This is the serious one, because it is the only check for the most severe categories. Its availability requirement is higher than anything else in the pipeline — replicate it aggressively, cache it locally, and treat its outage as a page rather than a warning.

Enforcement propagation is broken. Decisions are being made and not applied. Invisible from the model's side, since everything looks like it is working. The detection is an end-to-end probe: enforce a known test item and verify it stops being served.

That last one is worth proposing explicitly. It is the only check that verifies the whole chain rather than its parts, and the failure it catches is one where every component reports healthy.

Cost

The arithmetic that shapes the tiering, and it is worth being able to sketch.

Text classification is cheap enough to run on everything. Image classification is affordable on everything at platform scale with effort. Video is the one that forces choices — dense analysis of all uploaded video is prohibitive at scale, which is precisely why the tiered pipeline exists.

The design conclusion is the same as the reach argument: spend the expensive analysis where the exposure is, and accept cheap coverage everywhere else. A uniform policy either bankrupts the pipeline or under-protects the content that matters.

Next: the whole thing, as an interview.