diff --git a/Cargo.lock b/Cargo.lock
index 74203f3c..d65faa84 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5787,6 +5787,7 @@ dependencies = [
 name = "llm-access-core"
 version = "0.1.0"
 dependencies = [
+ "aho-corasick",
  "anyhow",
  "async-trait",
  "base64 0.22.1",
diff --git a/Cargo.toml b/Cargo.toml
index b6f1dd82..a2cceba8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -47,6 +47,7 @@ httparse = "1"
 lru = "0.16.3"
 once_cell = "1"
 ahash = "0.8.12"
+aho-corasick = "1.1"
 
 # 日志
 log = "0.4"
diff --git a/crates/backend/src/routes.rs b/crates/backend/src/routes.rs
index b9bf2105..c33e993c 100644
--- a/crates/backend/src/routes.rs
+++ b/crates/backend/src/routes.rs
@@ -516,8 +516,10 @@ pub fn create_router(state: AppState) -> Router {
         .route("/api/llm-access/*path", any(crate::llm_access_admin_proxy::proxy_public_request))
         .route("/admin/llm-gateway", get(seo::seo_spa_shell))
         .route("/admin/llm-gateway/monitor", get(seo::seo_spa_shell))
+        .route("/admin/llm-gateway/moderation", get(seo::seo_spa_shell))
         .route("/static_flow/admin/llm-gateway", get(seo::seo_spa_shell))
         .route("/static_flow/admin/llm-gateway/monitor", get(seo::seo_spa_shell))
+        .route("/static_flow/admin/llm-gateway/moderation", get(seo::seo_spa_shell))
         .route("/admin/kiro-gateway", get(seo::seo_spa_shell))
         .route("/admin/kiro-gateway/accounts", any(admin_kiro_accounts_entry))
         .route("/admin/kiro-gateway/upstream-channels", get(seo::seo_spa_shell))
diff --git a/crates/frontend/src/api.rs b/crates/frontend/src/api.rs
index f30e1b5f..15ad6309 100644
--- a/crates/frontend/src/api.rs
+++ b/crates/frontend/src/api.rs
@@ -10966,6 +10966,137 @@ pub struct TestAdminAnthropicUpstreamModelInput {
     pub model: String,
 }
 
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationKeywordView {
+    pub id: i64,
+    pub keyword: String,
+    pub categories: Vec<String>,
+    pub note: Option<String>,
+    pub source: String,
+    pub created_at_ms: i64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationCategoryView {
+    pub code: String,
+    pub label: String,
+    pub description: String,
+    pub severity: String,
+    pub created_at_ms: i64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct AdminModerationCategoriesResponse {
+    pub categories: Vec<ModerationCategoryView>,
+    pub generated_at: i64,
+}
+
+#[derive(Debug, Serialize, Clone, PartialEq, Default)]
+pub struct AddAdminModerationCategoryInput {
+    pub code: String,
+    pub label: String,
+    pub description: Option<String>,
+    pub severity: Option<String>,
+}
+
+#[derive(Debug, Serialize, Clone, PartialEq, Default)]
+pub struct AddAdminModerationCategoriesInput {
+    pub categories: Vec<AddAdminModerationCategoryInput>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationGateStatsView {
+    pub loaded: bool,
+    pub loaded_at_ms: Option<i64>,
+    pub keyword_count: usize,
+    pub banned_session_count: usize,
+    pub suppressed_hit_count: usize,
+    pub blocked_requests_total: u64,
+    pub persist_failures_total: u64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct AdminModerationKeywordsResponse {
+    pub keywords: Vec<ModerationKeywordView>,
+    pub total: usize,
+    pub stats: ModerationGateStatsView,
+    pub generated_at: i64,
+}
+
+#[derive(Debug, Serialize, Clone, PartialEq, Default)]
+pub struct AddAdminModerationKeywordsInput {
+    pub content: String,
+    pub format: Option<String>,
+    pub note: Option<String>,
+    pub categories: Vec<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct AddAdminModerationKeywordsResponse {
+    pub inserted: usize,
+    pub duplicates: usize,
+    pub parsed: usize,
+    pub generated_at: i64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationBannedSessionView {
+    pub id: i64,
+    pub hit_key: String,
+    pub session_key: String,
+    pub provider: String,
+    pub key_id: String,
+    pub key_name: String,
+    pub session_id: String,
+    pub matched_keyword: String,
+    pub matched_categories: Vec<String>,
+    pub matched_context: String,
+    pub match_start: i64,
+    pub match_end: i64,
+    pub match_prefix_sha256: String,
+    pub keyword_set_hash: String,
+    pub endpoint: String,
+    pub model: String,
+    pub client_ip: String,
+    pub status: String,
+    pub review_note: Option<String>,
+    pub banned_at_ms: i64,
+    pub reviewed_at_ms: Option<i64>,
+    pub updated_at_ms: i64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationBannedSessionDetailView {
+    pub session: ModerationBannedSessionView,
+    pub request_headers_json: String,
+    pub request_body_json: String,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct AdminModerationBannedSessionsResponse {
+    pub sessions: Vec<ModerationBannedSessionView>,
+    pub total: usize,
+    pub limit: usize,
+    pub offset: usize,
+    pub has_more: bool,
+    pub generated_at: i64,
+}
+
+#[derive(Debug, Serialize, Clone, PartialEq, Default)]
+pub struct ReviewModerationBannedSessionInput {
+    pub banned: bool,
+    pub review_note: Option<String>,
+}
+
 #[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
 #[serde(default)]
 pub struct KiroAccountView {
@@ -12050,6 +12181,255 @@ pub async fn delete_admin_anthropic_upstream_channel(name: &str) -> Result<(), S
     }
 }
 
+pub async fn fetch_admin_moderation_categories() -> Result<AdminModerationCategoriesResponse, String>
+{
+    #[cfg(feature = "mock")]
+    {
+        Ok(AdminModerationCategoriesResponse::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/categories", llm_access_admin_base());
+        let response = api_get(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn add_admin_moderation_categories(
+    input: &AddAdminModerationCategoriesInput,
+) -> Result<(), String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = input;
+        Ok(())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/categories", llm_access_admin_base());
+        let response = api_post(&url)
+            .json(input)
+            .map_err(|e| format!("Serialize error: {:?}", e))?
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        Ok(())
+    }
+}
+
+pub async fn delete_admin_moderation_category(code: &str) -> Result<(), String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = code;
+        Ok(())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!(
+            "{}/admin/llm-gateway/moderation/categories/{}",
+            llm_access_admin_base(),
+            urlencoding::encode(code)
+        );
+        let response = api_delete(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        Ok(())
+    }
+}
+
+pub async fn fetch_admin_moderation_keywords() -> Result<AdminModerationKeywordsResponse, String> {
+    #[cfg(feature = "mock")]
+    {
+        Ok(AdminModerationKeywordsResponse::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/keywords", llm_access_admin_base());
+        let response = api_get(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn add_admin_moderation_keywords(
+    input: &AddAdminModerationKeywordsInput,
+) -> Result<AddAdminModerationKeywordsResponse, String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = input;
+        Ok(AddAdminModerationKeywordsResponse::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/keywords", llm_access_admin_base());
+        let response = api_post(&url)
+            .json(input)
+            .map_err(|e| format!("Serialize error: {:?}", e))?
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn delete_admin_moderation_keyword(id: i64) -> Result<(), String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = id;
+        Ok(())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/keywords/{id}", llm_access_admin_base());
+        let response = api_delete(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        Ok(())
+    }
+}
+
+pub async fn fetch_admin_moderation_banned_sessions(
+    status: &str,
+    limit: usize,
+    offset: usize,
+) -> Result<AdminModerationBannedSessionsResponse, String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = (status, limit, offset);
+        Ok(AdminModerationBannedSessionsResponse::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!(
+            "{}/admin/llm-gateway/moderation/banned-sessions?status={}&limit={limit}&\
+             offset={offset}",
+            llm_access_admin_base(),
+            urlencoding::encode(status)
+        );
+        let response = api_get(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn fetch_admin_moderation_banned_session(
+    id: i64,
+) -> Result<ModerationBannedSessionDetailView, String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = id;
+        Ok(ModerationBannedSessionDetailView::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!(
+            "{}/admin/llm-gateway/moderation/banned-sessions/{id}",
+            llm_access_admin_base()
+        );
+        let response = api_get(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn review_admin_moderation_banned_session(
+    id: i64,
+    input: &ReviewModerationBannedSessionInput,
+) -> Result<ModerationBannedSessionView, String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = (id, input);
+        Ok(ModerationBannedSessionView::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!(
+            "{}/admin/llm-gateway/moderation/banned-sessions/{id}/review",
+            llm_access_admin_base()
+        );
+        let response = api_post(&url)
+            .json(input)
+            .map_err(|e| format!("Serialize error: {:?}", e))?
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
 pub async fn fetch_admin_kiro_accounts() -> Result<AdminKiroAccountsResponse, String> {
     #[cfg(feature = "mock")]
     {
diff --git a/crates/frontend/src/pages/admin_llm_gateway.rs b/crates/frontend/src/pages/admin_llm_gateway.rs
index 5cd081c7..a04f85c1 100644
--- a/crates/frontend/src/pages/admin_llm_gateway.rs
+++ b/crates/frontend/src/pages/admin_llm_gateway.rs
@@ -6631,6 +6631,7 @@ pub fn admin_llm_gateway_page() -> Html {
                         <div class={classes!("flex", "gap-2", "flex-wrap")}>
                             <Link<Route> to={Route::Admin} classes={classes!("btn-terminal")}>{ "Admin 首页" }</Link<Route>>
                             <Link<Route> to={Route::AdminLlmGatewayMonitor} classes={classes!("btn-terminal")}>{ "监控页" }</Link<Route>>
+                            <Link<Route> to={Route::AdminLlmGatewayModeration} classes={classes!("btn-terminal")}>{ "关键词审核" }</Link<Route>>
                             <Link<Route> to={Route::LlmAccess} classes={classes!("btn-terminal", "btn-terminal-primary")}>{ "公共页" }</Link<Route>>
                         </div>
                     </div>
diff --git a/crates/frontend/src/pages/admin_moderation.rs b/crates/frontend/src/pages/admin_moderation.rs
new file mode 100644
index 00000000..bde74525
--- /dev/null
+++ b/crates/frontend/src/pages/admin_moderation.rs
@@ -0,0 +1,953 @@
+//! Keyword moderation review console.
+//!
+//! Three tabs: **Keywords** (import via txt/json with category tagging, list,
+//! delete), **Banned sessions** (list captured bans, inspect the full request
+//! payload, keep or lift a ban), and **Categories** (manage the risk-category
+//! taxonomy). Backed by the `/admin/llm-gateway/moderation/*` endpoints on the
+//! cloud `llm-access` service.
+
+use std::collections::BTreeMap;
+
+use web_sys::{HtmlInputElement, HtmlSelectElement, HtmlTextAreaElement};
+use yew::prelude::*;
+use yew_router::prelude::Link;
+
+use crate::{
+    api::{
+        add_admin_moderation_categories, add_admin_moderation_keywords,
+        delete_admin_moderation_category, delete_admin_moderation_keyword,
+        fetch_admin_moderation_banned_session, fetch_admin_moderation_banned_sessions,
+        fetch_admin_moderation_categories, fetch_admin_moderation_keywords,
+        review_admin_moderation_banned_session, AddAdminModerationCategoriesInput,
+        AddAdminModerationCategoryInput, AddAdminModerationKeywordsInput,
+        AdminModerationBannedSessionsResponse, AdminModerationCategoriesResponse,
+        AdminModerationKeywordsResponse, ModerationBannedSessionDetailView, ModerationCategoryView,
+        ReviewModerationBannedSessionInput,
+    },
+    components::tab_bar::render_tab_bar,
+    pages::llm_access_shared::{confirm_destructive, format_timestamp_opt},
+    router::Route,
+};
+
+const TAB_KEYWORDS: &str = "keywords";
+const TAB_SESSIONS: &str = "sessions";
+const TAB_CATEGORIES: &str = "categories";
+const SESSIONS_PAGE_SIZE: usize = 50;
+
+fn provider_badge(provider: &str) -> Classes {
+    let base = classes!("rounded-full", "px-2", "py-1", "font-mono", "text-xs", "font-semibold");
+    let color = if provider == "codex" {
+        classes!("bg-sky-500/10", "text-sky-700", "dark:text-sky-200")
+    } else {
+        classes!("bg-violet-500/10", "text-violet-700", "dark:text-violet-200")
+    };
+    classes!(base, color)
+}
+
+/// Color a category badge by the category's severity.
+fn severity_badge(severity: &str) -> Classes {
+    let base = classes!("rounded-full", "px-2", "py-0.5", "font-mono", "text-[11px]");
+    let color = match severity {
+        "critical" => classes!("bg-red-500/15", "text-red-700", "dark:text-red-200"),
+        "high" => classes!("bg-amber-500/15", "text-amber-700", "dark:text-amber-200"),
+        "low" => classes!("bg-slate-500/10", "text-slate-600", "dark:text-slate-300"),
+        _ => classes!("bg-indigo-500/10", "text-indigo-700", "dark:text-indigo-200"),
+    };
+    classes!(base, color)
+}
+
+/// Render the category codes for a keyword/ban as labeled, severity-colored
+/// badges, resolving each code to its label + severity via `lookup`.
+fn category_badges(codes: &[String], lookup: &BTreeMap<String, ModerationCategoryView>) -> Html {
+    if codes.is_empty() {
+        return html! { <span class={classes!("text-xs", "text-[var(--muted)]")}>{ "—" }</span> };
+    }
+    html! {
+        <div class={classes!("flex", "flex-wrap", "gap-1")}>
+            { for codes.iter().map(|code| {
+                let (label, severity) = lookup
+                    .get(code)
+                    .map(|c| (c.label.clone(), c.severity.clone()))
+                    .unwrap_or_else(|| (code.clone(), "medium".to_string()));
+                html! { <span class={severity_badge(&severity)} title={code.clone()}>{ label }</span> }
+            }) }
+        </div>
+    }
+}
+
+fn status_badge(status: &str) -> Classes {
+    let base = classes!("rounded-full", "px-2", "py-1", "font-mono", "text-xs");
+    let color = if status == "banned" {
+        classes!("bg-red-500/10", "text-red-700", "dark:text-red-200")
+    } else {
+        classes!("bg-emerald-500/10", "text-emerald-700", "dark:text-emerald-200")
+    };
+    classes!(base, color)
+}
+
+fn pretty_json(raw: &str) -> String {
+    serde_json::from_str::<serde_json::Value>(raw)
+        .ok()
+        .and_then(|value| serde_json::to_string_pretty(&value).ok())
+        .unwrap_or_else(|| raw.to_string())
+}
+
+#[function_component(AdminModerationPage)]
+pub fn admin_moderation_page() -> Html {
+    let active_tab = use_state(|| TAB_KEYWORDS.to_string());
+    let error = use_state(|| None::<String>);
+    let flash = use_state(|| None::<String>);
+    let refresh_tick = use_state(|| 0u64);
+
+    // Category tab / shared lookup state.
+    let categories = use_state(AdminModerationCategoriesResponse::default);
+    let new_category_code = use_state(String::new);
+    let new_category_label = use_state(String::new);
+    let new_category_severity = use_state(|| "medium".to_string());
+
+    // Keyword tab state.
+    let keywords = use_state(AdminModerationKeywordsResponse::default);
+    let keywords_loading = use_state(|| true);
+    let import_content = use_state(String::new);
+    let import_format = use_state(|| "txt".to_string());
+    let import_note = use_state(String::new);
+    let import_categories = use_state(Vec::<String>::new);
+    let importing = use_state(|| false);
+
+    // Banned session tab state.
+    let sessions = use_state(AdminModerationBannedSessionsResponse::default);
+    let sessions_loading = use_state(|| true);
+    let session_status = use_state(|| "banned".to_string());
+    let session_offset = use_state(|| 0usize);
+    let selected_detail = use_state(|| None::<ModerationBannedSessionDetailView>);
+    let detail_loading = use_state(|| false);
+
+    let notify = {
+        let flash = flash.clone();
+        let error = error.clone();
+        Callback::from(move |(message, is_error): (String, bool)| {
+            if is_error {
+                error.set(Some(message));
+                flash.set(None);
+            } else {
+                flash.set(Some(message));
+                error.set(None);
+            }
+        })
+    };
+
+    let reload = {
+        let refresh_tick = refresh_tick.clone();
+        Callback::from(move |_| refresh_tick.set((*refresh_tick).saturating_add(1)))
+    };
+
+    // Load categories (used by the Categories tab and by badge/import lookups).
+    {
+        let categories = categories.clone();
+        let error = error.clone();
+        let tick = *refresh_tick;
+        use_effect_with(tick, move |_| {
+            wasm_bindgen_futures::spawn_local(async move {
+                match fetch_admin_moderation_categories().await {
+                    Ok(response) => categories.set(response),
+                    Err(message) => error.set(Some(message)),
+                }
+            });
+            || ()
+        });
+    }
+
+    // Code -> category lookup for rendering labeled, severity-colored badges.
+    let category_lookup: BTreeMap<String, ModerationCategoryView> = categories
+        .categories
+        .iter()
+        .map(|category| (category.code.clone(), category.clone()))
+        .collect();
+
+    // Load keywords.
+    {
+        let keywords = keywords.clone();
+        let keywords_loading = keywords_loading.clone();
+        let error = error.clone();
+        let tick = *refresh_tick;
+        use_effect_with(tick, move |_| {
+            keywords_loading.set(true);
+            wasm_bindgen_futures::spawn_local(async move {
+                match fetch_admin_moderation_keywords().await {
+                    Ok(response) => {
+                        error.set(None);
+                        keywords.set(response);
+                    },
+                    Err(message) => error.set(Some(message)),
+                }
+                keywords_loading.set(false);
+            });
+            || ()
+        });
+    }
+
+    // Load banned sessions (re-runs on tick, status filter, or page change).
+    {
+        let sessions = sessions.clone();
+        let sessions_loading = sessions_loading.clone();
+        let error = error.clone();
+        let status = (*session_status).clone();
+        let offset = *session_offset;
+        let deps = (*refresh_tick, status.clone(), offset);
+        use_effect_with(deps, move |_| {
+            sessions_loading.set(true);
+            wasm_bindgen_futures::spawn_local(async move {
+                match fetch_admin_moderation_banned_sessions(&status, SESSIONS_PAGE_SIZE, offset)
+                    .await
+                {
+                    Ok(response) => {
+                        error.set(None);
+                        sessions.set(response);
+                    },
+                    Err(message) => error.set(Some(message)),
+                }
+                sessions_loading.set(false);
+            });
+            || ()
+        });
+    }
+
+    let on_tab_click = {
+        let active_tab = active_tab.clone();
+        Callback::from(move |tab: String| active_tab.set(tab))
+    };
+
+    let on_import = {
+        let import_content = import_content.clone();
+        let import_format = import_format.clone();
+        let import_note = import_note.clone();
+        let import_categories = import_categories.clone();
+        let importing = importing.clone();
+        let notify = notify.clone();
+        let reload = reload.clone();
+        Callback::from(move |_| {
+            if *importing {
+                return;
+            }
+            let content = (*import_content).clone();
+            if content.trim().is_empty() {
+                notify.emit(("Keyword content is empty".to_string(), true));
+                return;
+            }
+            let note = (*import_note).clone();
+            let input = AddAdminModerationKeywordsInput {
+                content,
+                format: Some((*import_format).clone()),
+                note: (!note.trim().is_empty()).then(|| note.trim().to_string()),
+                categories: (*import_categories).clone(),
+            };
+            let importing = importing.clone();
+            let notify = notify.clone();
+            let reload = reload.clone();
+            let import_content = import_content.clone();
+            importing.set(true);
+            wasm_bindgen_futures::spawn_local(async move {
+                match add_admin_moderation_keywords(&input).await {
+                    Ok(outcome) => {
+                        notify.emit((
+                            format!(
+                                "Imported {} keyword(s), {} duplicate(s) skipped (parsed {})",
+                                outcome.inserted, outcome.duplicates, outcome.parsed
+                            ),
+                            false,
+                        ));
+                        import_content.set(String::new());
+                        reload.emit(());
+                    },
+                    Err(message) => notify.emit((message, true)),
+                }
+                importing.set(false);
+            });
+        })
+    };
+
+    let keywords_view = {
+        let import_content = import_content.clone();
+        let import_format = import_format.clone();
+        let import_note = import_note.clone();
+        let import_categories = import_categories.clone();
+        let importing = importing.clone();
+        let keywords = keywords.clone();
+        let keywords_loading = keywords_loading.clone();
+        let categories = categories.clone();
+        let category_lookup = category_lookup.clone();
+        let notify = notify.clone();
+        let reload = reload.clone();
+
+        let on_content_input = {
+            let import_content = import_content.clone();
+            Callback::from(move |e: InputEvent| {
+                let target: HtmlTextAreaElement = e.target_unchecked_into();
+                import_content.set(target.value());
+            })
+        };
+        let on_format_change = {
+            let import_format = import_format.clone();
+            Callback::from(move |e: Event| {
+                let target: HtmlSelectElement = e.target_unchecked_into();
+                import_format.set(target.value());
+            })
+        };
+        let on_note_input = {
+            let import_note = import_note.clone();
+            Callback::from(move |e: InputEvent| {
+                let target: HtmlInputElement = e.target_unchecked_into();
+                import_note.set(target.value());
+            })
+        };
+
+        let stats = keywords.stats.clone();
+        html! {
+            <div class={classes!("space-y-4")}>
+                <div class={classes!("grid", "gap-3", "sm:grid-cols-2", "lg:grid-cols-4")}>
+                    { stat_card("Keywords", stats.keyword_count.to_string(), stats.loaded) }
+                    { stat_card("Banned sessions", stats.banned_session_count.to_string(), stats.loaded) }
+                    { stat_card("Suppressed hits", stats.suppressed_hit_count.to_string(), stats.loaded) }
+                    { stat_card("Blocked requests", stats.blocked_requests_total.to_string(), stats.loaded) }
+                </div>
+
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-5", "space-y-3")}>
+                    <h3 class={classes!("font-mono", "text-xs", "uppercase", "tracking-[0.16em]", "text-[var(--muted)]")}>
+                        { "Import keywords" }
+                    </h3>
+                    <textarea
+                        class={classes!("w-full", "min-h-[8rem]", "rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "p-3", "font-mono", "text-sm")}
+                        placeholder={"txt: one keyword (or space-separated phrase) per line\njson: [\"phrase a\", \"phrase b\"] or {\"keywords\": [...]}"}
+                        value={(*import_content).clone()}
+                        oninput={on_content_input}
+                    />
+                    <div class={classes!("flex", "flex-wrap", "items-center", "gap-3")}>
+                        <select
+                            class={classes!("rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                            onchange={on_format_change}
+                        >
+                            <option value="txt" selected={*import_format == "txt"}>{ "Plain text (.txt)" }</option>
+                            <option value="json" selected={*import_format == "json"}>{ "JSON" }</option>
+                        </select>
+                        <input
+                            type="text"
+                            class={classes!("flex-1", "min-w-[12rem]", "rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                            placeholder="Optional note for this batch"
+                            value={(*import_note).clone()}
+                            oninput={on_note_input}
+                        />
+                        <button
+                            type="button"
+                            class={classes!("btn-terminal", "btn-terminal-primary")}
+                            disabled={*importing}
+                            onclick={on_import}
+                        >
+                            { if *importing { "Importing…" } else { "Import" } }
+                        </button>
+                    </div>
+                    <div>
+                        <div class={classes!("font-mono", "text-[11px]", "uppercase", "tracking-wider", "text-[var(--muted)]", "mb-1.5")}>
+                            { "Tag imported keywords with categories" }
+                        </div>
+                        if categories.categories.is_empty() {
+                            <div class={classes!("text-xs", "text-[var(--muted)]")}>
+                                { "No categories yet — add some in the Categories tab." }
+                            </div>
+                        } else {
+                            <div class={classes!("flex", "flex-wrap", "gap-2")}>
+                                { for categories.categories.iter().map(|category| {
+                                    let code = category.code.clone();
+                                    let checked = import_categories.contains(&code);
+                                    let on_toggle = {
+                                        let import_categories = import_categories.clone();
+                                        let code = code.clone();
+                                        Callback::from(move |_| {
+                                            let mut next = (*import_categories).clone();
+                                            if let Some(pos) = next.iter().position(|c| c == &code) {
+                                                next.remove(pos);
+                                            } else {
+                                                next.push(code.clone());
+                                            }
+                                            import_categories.set(next);
+                                        })
+                                    };
+                                    html! {
+                                        <label class={classes!("inline-flex", "items-center", "gap-1.5", "cursor-pointer", "rounded-lg", "border", "border-[var(--border)]", "px-2.5", "py-1")}>
+                                            <input type="checkbox" checked={checked} onchange={on_toggle} />
+                                            <span class={severity_badge(&category.severity)} title={category.code.clone()}>{ &category.label }</span>
+                                        </label>
+                                    }
+                                }) }
+                            </div>
+                        }
+                    </div>
+                </div>
+
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "overflow-hidden")}>
+                    if *keywords_loading {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "Loading keywords…" }</div>
+                    } else if keywords.keywords.is_empty() {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "No keywords configured." }</div>
+                    } else {
+                        <div class={classes!("overflow-x-auto")}>
+                            <table class={classes!("w-full", "min-w-[40rem]", "text-sm")}>
+                                <thead>
+                                    <tr class={classes!("border-b", "border-[var(--border)]", "text-left", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Keyword" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Categories" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Source" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Note" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Added" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    { for keywords.keywords.iter().map(|keyword| {
+                                        let id = keyword.id;
+                                        let keyword_text = keyword.keyword.clone();
+                                        let on_delete = {
+                                            let notify = notify.clone();
+                                            let reload = reload.clone();
+                                            let keyword_text = keyword_text.clone();
+                                            Callback::from(move |_| {
+                                                if !confirm_destructive(&format!("Delete keyword \"{keyword_text}\"?")) {
+                                                    return;
+                                                }
+                                                let notify = notify.clone();
+                                                let reload = reload.clone();
+                                                wasm_bindgen_futures::spawn_local(async move {
+                                                    match delete_admin_moderation_keyword(id).await {
+                                                        Ok(()) => {
+                                                            notify.emit(("Keyword deleted".to_string(), false));
+                                                            reload.emit(());
+                                                        },
+                                                        Err(message) => notify.emit((message, true)),
+                                                    }
+                                                });
+                                            })
+                                        };
+                                        html! {
+                                            <tr class={classes!("border-b", "border-[var(--border)]/50")}>
+                                                <td class={classes!("px-4", "py-2", "font-mono", "break-all")}>{ &keyword.keyword }</td>
+                                                <td class={classes!("px-4", "py-2")}>{ category_badges(&keyword.categories, &category_lookup) }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ &keyword.source }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ keyword.note.clone().unwrap_or_default() }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]", "whitespace-nowrap")}>{ format_timestamp_opt(Some(keyword.created_at_ms)) }</td>
+                                                <td class={classes!("px-4", "py-2", "text-right")}>
+                                                    <button type="button" class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")} onclick={on_delete}>
+                                                        { "Delete" }
+                                                    </button>
+                                                </td>
+                                            </tr>
+                                        }
+                                    }) }
+                                </tbody>
+                            </table>
+                        </div>
+                    }
+                </div>
+            </div>
+        }
+    };
+
+    let sessions_view = {
+        let sessions = sessions.clone();
+        let sessions_loading = sessions_loading.clone();
+        let session_status = session_status.clone();
+        let session_offset = session_offset.clone();
+        let selected_detail = selected_detail.clone();
+        let detail_loading = detail_loading.clone();
+        let category_lookup = category_lookup.clone();
+        let notify = notify.clone();
+        let reload = reload.clone();
+
+        let on_status_change = {
+            let session_status = session_status.clone();
+            let session_offset = session_offset.clone();
+            Callback::from(move |e: Event| {
+                let target: HtmlSelectElement = e.target_unchecked_into();
+                session_status.set(target.value());
+                // Reset to the first page whenever the filter changes.
+                session_offset.set(0);
+            })
+        };
+
+        let offset = *session_offset;
+        let on_prev = {
+            let session_offset = session_offset.clone();
+            Callback::from(move |_| {
+                session_offset.set(offset.saturating_sub(SESSIONS_PAGE_SIZE));
+            })
+        };
+        let on_next = {
+            let session_offset = session_offset.clone();
+            Callback::from(move |_| session_offset.set(offset + SESSIONS_PAGE_SIZE))
+        };
+        let page_start = if sessions.total == 0 { 0 } else { offset + 1 };
+        let page_end = offset + sessions.sessions.len();
+
+        html! {
+            <div class={classes!("space-y-4")}>
+                <div class={classes!("flex", "flex-wrap", "items-center", "gap-3")}>
+                    <span class={classes!("font-mono", "text-xs", "uppercase", "tracking-[0.16em]", "text-[var(--muted)]")}>{ "Filter" }</span>
+                    <select
+                        class={classes!("rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                        onchange={on_status_change}
+                    >
+                        <option value="banned" selected={*session_status == "banned"}>{ "Banned" }</option>
+                        <option value="unbanned" selected={*session_status == "unbanned"}>{ "Unbanned" }</option>
+                        <option value="all" selected={*session_status == "all"}>{ "All" }</option>
+                    </select>
+                    <span class={classes!("text-sm", "text-[var(--muted)]")}>
+                        { format!("{page_start}–{page_end} of {} record(s)", sessions.total) }
+                    </span>
+                    <div class={classes!("ml-auto", "flex", "items-center", "gap-2")}>
+                        <button
+                            type="button"
+                            class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")}
+                            disabled={offset == 0}
+                            onclick={on_prev}
+                        >
+                            { "‹ Prev" }
+                        </button>
+                        <button
+                            type="button"
+                            class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")}
+                            disabled={!sessions.has_more}
+                            onclick={on_next}
+                        >
+                            { "Next ›" }
+                        </button>
+                    </div>
+                </div>
+
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "overflow-hidden")}>
+                    if *sessions_loading {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "Loading banned sessions…" }</div>
+                    } else if sessions.sessions.is_empty() {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "No banned sessions." }</div>
+                    } else {
+                        <div class={classes!("overflow-x-auto")}>
+                            <table class={classes!("w-full", "min-w-[60rem]", "text-sm")}>
+                                <thead>
+                                    <tr class={classes!("border-b", "border-[var(--border)]", "text-left", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Provider" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Key" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Matched keyword" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Categories" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Status" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Banned at" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    { for sessions.sessions.iter().map(|session| {
+                                        let id = session.id;
+                                        let is_banned = session.status == "banned";
+
+                                        let on_view = {
+                                            let selected_detail = selected_detail.clone();
+                                            let detail_loading = detail_loading.clone();
+                                            let notify = notify.clone();
+                                            Callback::from(move |_| {
+                                                let selected_detail = selected_detail.clone();
+                                                let detail_loading = detail_loading.clone();
+                                                let notify = notify.clone();
+                                                detail_loading.set(true);
+                                                wasm_bindgen_futures::spawn_local(async move {
+                                                    match fetch_admin_moderation_banned_session(id).await {
+                                                        Ok(detail) => selected_detail.set(Some(detail)),
+                                                        Err(message) => notify.emit((message, true)),
+                                                    }
+                                                    detail_loading.set(false);
+                                                });
+                                            })
+                                        };
+
+                                        let on_toggle = {
+                                            let notify = notify.clone();
+                                            let reload = reload.clone();
+                                            let selected_detail = selected_detail.clone();
+                                            Callback::from(move |_| {
+                                                let target_banned = !is_banned;
+                                                let verb = if target_banned { "re-ban" } else { "unban" };
+                                                if !confirm_destructive(&format!("Are you sure you want to {verb} this session?")) {
+                                                    return;
+                                                }
+                                                let input = ReviewModerationBannedSessionInput {
+                                                    banned: target_banned,
+                                                    review_note: None,
+                                                };
+                                                let notify = notify.clone();
+                                                let reload = reload.clone();
+                                                let selected_detail = selected_detail.clone();
+                                                wasm_bindgen_futures::spawn_local(async move {
+                                                    match review_admin_moderation_banned_session(id, &input).await {
+                                                        Ok(_) => {
+                                                            notify.emit((
+                                                                if target_banned { "Session re-banned".to_string() } else { "Session unbanned".to_string() },
+                                                                false,
+                                                            ));
+                                                            // Close the detail panel so its now-stale status is not shown.
+                                                            if selected_detail.as_ref().is_some_and(|d| d.session.id == id) {
+                                                                selected_detail.set(None);
+                                                            }
+                                                            reload.emit(());
+                                                        },
+                                                        Err(message) => notify.emit((message, true)),
+                                                    }
+                                                });
+                                            })
+                                        };
+
+                                        html! {
+                                            <tr class={classes!("border-b", "border-[var(--border)]/50")}>
+                                                <td class={classes!("px-4", "py-2")}>
+                                                    <span class={provider_badge(&session.provider)}>{ &session.provider }</span>
+                                                </td>
+                                                <td class={classes!("px-4", "py-2")}>
+                                                    <div class={classes!("font-mono", "text-xs", "break-all")}>{ &session.key_name }</div>
+                                                    <div class={classes!("font-mono", "text-[10px]", "text-[var(--muted)]", "break-all")}>{ &session.key_id }</div>
+                                                </td>
+                                                <td class={classes!("px-4", "py-2", "font-mono", "text-xs", "break-all")}>{ &session.matched_keyword }</td>
+                                                <td class={classes!("px-4", "py-2")}>{ category_badges(&session.matched_categories, &category_lookup) }</td>
+                                                <td class={classes!("px-4", "py-2")}>
+                                                    <span class={status_badge(&session.status)}>{ &session.status }</span>
+                                                </td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]", "whitespace-nowrap")}>{ format_timestamp_opt(Some(session.banned_at_ms)) }</td>
+                                                <td class={classes!("px-4", "py-2", "text-right", "space-x-2", "whitespace-nowrap")}>
+                                                    <button type="button" class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")} onclick={on_view}>
+                                                        { "View" }
+                                                    </button>
+                                                    <button
+                                                        type="button"
+                                                        class={classes!("btn-terminal", if is_banned { "btn-terminal-primary" } else { "" }, "!px-2.5", "!py-1.5", "!text-xs")}
+                                                        onclick={on_toggle}
+                                                    >
+                                                        { if is_banned { "Unban" } else { "Re-ban" } }
+                                                    </button>
+                                                </td>
+                                            </tr>
+                                        }
+                                    }) }
+                                </tbody>
+                            </table>
+                        </div>
+                    }
+                </div>
+
+                { detail_panel(&selected_detail, *detail_loading, &category_lookup) }
+            </div>
+        }
+    };
+
+    let categories_view = {
+        let categories = categories.clone();
+        let new_category_code = new_category_code.clone();
+        let new_category_label = new_category_label.clone();
+        let new_category_severity = new_category_severity.clone();
+        let notify = notify.clone();
+        let reload = reload.clone();
+
+        let on_code_input = {
+            let new_category_code = new_category_code.clone();
+            Callback::from(move |e: InputEvent| {
+                let target: HtmlInputElement = e.target_unchecked_into();
+                new_category_code.set(target.value());
+            })
+        };
+        let on_label_input = {
+            let new_category_label = new_category_label.clone();
+            Callback::from(move |e: InputEvent| {
+                let target: HtmlInputElement = e.target_unchecked_into();
+                new_category_label.set(target.value());
+            })
+        };
+        let on_severity_change = {
+            let new_category_severity = new_category_severity.clone();
+            Callback::from(move |e: Event| {
+                let target: HtmlSelectElement = e.target_unchecked_into();
+                new_category_severity.set(target.value());
+            })
+        };
+        let on_add_category = {
+            let new_category_code = new_category_code.clone();
+            let new_category_label = new_category_label.clone();
+            let new_category_severity = new_category_severity.clone();
+            let notify = notify.clone();
+            let reload = reload.clone();
+            Callback::from(move |_| {
+                let code = (*new_category_code).clone();
+                let label = (*new_category_label).clone();
+                if code.trim().is_empty() || label.trim().is_empty() {
+                    notify.emit(("Category code and label are required".to_string(), true));
+                    return;
+                }
+                let input = AddAdminModerationCategoriesInput {
+                    categories: vec![AddAdminModerationCategoryInput {
+                        code: code.trim().to_string(),
+                        label: label.trim().to_string(),
+                        description: None,
+                        severity: Some((*new_category_severity).clone()),
+                    }],
+                };
+                let notify = notify.clone();
+                let reload = reload.clone();
+                let new_category_code = new_category_code.clone();
+                let new_category_label = new_category_label.clone();
+                wasm_bindgen_futures::spawn_local(async move {
+                    match add_admin_moderation_categories(&input).await {
+                        Ok(()) => {
+                            notify.emit(("Category added".to_string(), false));
+                            new_category_code.set(String::new());
+                            new_category_label.set(String::new());
+                            reload.emit(());
+                        },
+                        Err(message) => notify.emit((message, true)),
+                    }
+                });
+            })
+        };
+
+        html! {
+            <div class={classes!("space-y-4")}>
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-5", "space-y-3")}>
+                    <h3 class={classes!("font-mono", "text-xs", "uppercase", "tracking-[0.16em]", "text-[var(--muted)]")}>
+                        { "Add category" }
+                    </h3>
+                    <div class={classes!("flex", "flex-wrap", "items-center", "gap-3")}>
+                        <input
+                            type="text"
+                            class={classes!("rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm", "font-mono")}
+                            placeholder="code (a-z0-9_)"
+                            value={(*new_category_code).clone()}
+                            oninput={on_code_input}
+                        />
+                        <input
+                            type="text"
+                            class={classes!("flex-1", "min-w-[12rem]", "rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                            placeholder="label"
+                            value={(*new_category_label).clone()}
+                            oninput={on_label_input}
+                        />
+                        <select
+                            class={classes!("rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                            onchange={on_severity_change}
+                        >
+                            { for ["critical", "high", "medium", "low"].iter().map(|sev| html! {
+                                <option value={*sev} selected={*new_category_severity == *sev}>{ *sev }</option>
+                            }) }
+                        </select>
+                        <button type="button" class={classes!("btn-terminal", "btn-terminal-primary")} onclick={on_add_category}>
+                            { "Add" }
+                        </button>
+                    </div>
+                </div>
+
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "overflow-hidden")}>
+                    if categories.categories.is_empty() {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "No categories configured." }</div>
+                    } else {
+                        <div class={classes!("overflow-x-auto")}>
+                            <table class={classes!("w-full", "min-w-[40rem]", "text-sm")}>
+                                <thead>
+                                    <tr class={classes!("border-b", "border-[var(--border)]", "text-left", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Category" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Code" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Severity" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Description" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    { for categories.categories.iter().map(|category| {
+                                        let code = category.code.clone();
+                                        let on_delete = {
+                                            let notify = notify.clone();
+                                            let reload = reload.clone();
+                                            let code = code.clone();
+                                            Callback::from(move |_| {
+                                                if !confirm_destructive(&format!("Delete category \"{code}\"?")) {
+                                                    return;
+                                                }
+                                                let notify = notify.clone();
+                                                let reload = reload.clone();
+                                                let code = code.clone();
+                                                wasm_bindgen_futures::spawn_local(async move {
+                                                    match delete_admin_moderation_category(&code).await {
+                                                        Ok(()) => {
+                                                            notify.emit(("Category deleted".to_string(), false));
+                                                            reload.emit(());
+                                                        },
+                                                        Err(message) => notify.emit((message, true)),
+                                                    }
+                                                });
+                                            })
+                                        };
+                                        html! {
+                                            <tr class={classes!("border-b", "border-[var(--border)]/50")}>
+                                                <td class={classes!("px-4", "py-2")}>
+                                                    <span class={severity_badge(&category.severity)}>{ &category.label }</span>
+                                                </td>
+                                                <td class={classes!("px-4", "py-2", "font-mono", "text-xs")}>{ &category.code }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ &category.severity }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ &category.description }</td>
+                                                <td class={classes!("px-4", "py-2", "text-right")}>
+                                                    <button type="button" class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")} onclick={on_delete}>
+                                                        { "Delete" }
+                                                    </button>
+                                                </td>
+                                            </tr>
+                                        }
+                                    }) }
+                                </tbody>
+                            </table>
+                        </div>
+                    }
+                </div>
+            </div>
+        }
+    };
+
+    html! {
+        <main class={classes!("min-h-screen", "bg-[var(--bg)]", "p-4")}>
+            <div class={classes!("mx-auto", "max-w-7xl", "space-y-4")}>
+                <div class={classes!("flex", "flex-wrap", "items-center", "justify-between", "gap-3")}>
+                    <div>
+                        <h1 class={classes!("text-xl", "font-semibold")}>{ "Keyword moderation" }</h1>
+                        <p class={classes!("text-sm", "text-[var(--muted)]")}>
+                            { "Block requests whose content matches banned keywords, and review flagged sessions." }
+                        </p>
+                    </div>
+                    <div class={classes!("flex", "items-center", "gap-2")}>
+                        <Link<Route> to={Route::AdminLlmGateway} classes={classes!("btn-terminal")}>
+                            { "← LLM Gateway" }
+                        </Link<Route>>
+                        <button type="button" class={classes!("btn-terminal")} onclick={reload.reform(|_| ())}>
+                            { "Refresh" }
+                        </button>
+                    </div>
+                </div>
+
+                if let Some(message) = (*flash).clone() {
+                    <div class={classes!("rounded-lg", "bg-emerald-500/10", "px-3", "py-2", "text-sm", "text-emerald-700", "dark:text-emerald-200")}>
+                        { message }
+                    </div>
+                }
+                if let Some(err) = (*error).clone() {
+                    <div class={classes!("rounded-lg", "bg-red-500/10", "px-3", "py-2", "text-sm", "text-red-700", "dark:text-red-200")}>
+                        { err }
+                    </div>
+                }
+
+                { render_tab_bar(
+                    &active_tab,
+                    &[
+                        (TAB_KEYWORDS, "Keywords"),
+                        (TAB_SESSIONS, "Banned sessions"),
+                        (TAB_CATEGORIES, "Categories"),
+                    ],
+                    &on_tab_click,
+                    None,
+                ) }
+
+                if *active_tab == TAB_KEYWORDS {
+                    { keywords_view }
+                } else if *active_tab == TAB_SESSIONS {
+                    { sessions_view }
+                } else {
+                    { categories_view }
+                }
+            </div>
+        </main>
+    }
+}
+
+fn stat_card(label: &str, value: String, loaded: bool) -> Html {
+    html! {
+        <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-4")}>
+            <div class={classes!("font-mono", "text-xs", "uppercase", "tracking-[0.16em]", "text-[var(--muted)]")}>{ label.to_string() }</div>
+            <div class={classes!("mt-1", "text-2xl", "font-semibold")}>{ if loaded { value } else { "…".to_string() } }</div>
+        </div>
+    }
+}
+
+fn detail_panel(
+    detail: &UseStateHandle<Option<ModerationBannedSessionDetailView>>,
+    loading: bool,
+    category_lookup: &BTreeMap<String, ModerationCategoryView>,
+) -> Html {
+    if loading {
+        return html! {
+            <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-5", "text-sm", "text-[var(--muted)]")}>
+                { "Loading captured request…" }
+            </div>
+        };
+    }
+    let Some(detail_value) = (**detail).clone() else {
+        return Html::default();
+    };
+    let on_close = {
+        let detail = detail.clone();
+        Callback::from(move |_| detail.set(None))
+    };
+    let detail = detail_value;
+    let session = &detail.session;
+    html! {
+        <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-5", "space-y-3")}>
+            <div class={classes!("flex", "flex-wrap", "items-center", "justify-between", "gap-2")}>
+                <h3 class={classes!("font-mono", "text-sm", "font-semibold")}>
+                    { format!("Captured request · session #{}", session.id) }
+                </h3>
+                <div class={classes!("flex", "items-center", "gap-2")}>
+                    <span class={status_badge(&session.status)}>{ &session.status }</span>
+                    <button
+                        type="button"
+                        class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")}
+                        title="Close"
+                        aria-label="Close captured request"
+                        onclick={on_close}
+                    >
+                        { "✕" }
+                    </button>
+                </div>
+            </div>
+            <div class={classes!("grid", "gap-2", "sm:grid-cols-2", "text-sm")}>
+                { detail_field("Provider", &session.provider) }
+                { detail_field("Endpoint", &session.endpoint) }
+                { detail_field("Model", &session.model) }
+                { detail_field("Client IP", &session.client_ip) }
+                { detail_field("Session id", &session.session_id) }
+                { detail_field("Matched keyword", &session.matched_keyword) }
+                { detail_field("Match range", &format!("{}..{}", session.match_start, session.match_end)) }
+            </div>
+            <div class={classes!("flex", "items-center", "gap-2")}>
+                <span class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>{ "Categories:" }</span>
+                { category_badges(&session.matched_categories, category_lookup) }
+            </div>
+            if !session.matched_context.is_empty() {
+                <div>
+                    <div class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]", "mb-1")}>{ "Matched context" }</div>
+                    <pre class={classes!("rounded-lg", "bg-[var(--bg)]", "p-3", "text-xs", "whitespace-pre-wrap", "break-words")}>{ &session.matched_context }</pre>
+                </div>
+            }
+            <div>
+                <div class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]", "mb-1")}>{ "Request headers" }</div>
+                <pre class={classes!("max-h-64", "overflow-auto", "rounded-lg", "bg-[var(--bg)]", "p-3", "text-xs")}>{ pretty_json(&detail.request_headers_json) }</pre>
+            </div>
+            <div>
+                <div class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]", "mb-1")}>{ "Request body" }</div>
+                <pre class={classes!("max-h-96", "overflow-auto", "rounded-lg", "bg-[var(--bg)]", "p-3", "text-xs")}>{ pretty_json(&detail.request_body_json) }</pre>
+            </div>
+        </div>
+    }
+}
+
+fn detail_field(label: &str, value: &str) -> Html {
+    html! {
+        <div>
+            <span class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>{ label.to_string() }{ ": " }</span>
+            <span class={classes!("font-mono", "break-all")}>{ if value.is_empty() { "-" } else { value } }</span>
+        </div>
+    }
+}
diff --git a/crates/frontend/src/pages/mod.rs b/crates/frontend/src/pages/mod.rs
index 3653c6a2..0306166f 100644
--- a/crates/frontend/src/pages/mod.rs
+++ b/crates/frontend/src/pages/mod.rs
@@ -11,6 +11,7 @@ pub mod admin_llm_gateway_monitor;
 pub mod admin_local_media;
 #[cfg(feature = "local-media")]
 pub mod admin_local_media_player;
+pub mod admin_moderation;
 pub mod admin_music_wish_stream;
 pub mod article_detail;
 pub mod article_raw;
diff --git a/crates/frontend/src/router.rs b/crates/frontend/src/router.rs
index 325036dd..4744abfb 100644
--- a/crates/frontend/src/router.rs
+++ b/crates/frontend/src/router.rs
@@ -143,6 +143,13 @@ pub enum Route {
     #[at("/static_flow/admin/llm-gateway/monitor")]
     AdminLlmGatewayMonitor,
 
+    #[cfg(not(feature = "mock"))]
+    #[at("/admin/llm-gateway/moderation")]
+    AdminLlmGatewayModeration,
+    #[cfg(feature = "mock")]
+    #[at("/static_flow/admin/llm-gateway/moderation")]
+    AdminLlmGatewayModeration,
+
     #[cfg(not(feature = "mock"))]
     #[at("/admin/kiro-gateway")]
     AdminKiroGateway,
@@ -290,6 +297,9 @@ fn switch(route: Route) -> Html {
         Route::AdminLlmGatewayMonitor => {
             html! { <pages::admin_llm_gateway_monitor::AdminLlmGatewayMonitorPage /> }
         },
+        Route::AdminLlmGatewayModeration => {
+            html! { <pages::admin_moderation::AdminModerationPage /> }
+        },
         Route::AdminKiroGateway => html! { <pages::admin_kiro_gateway::AdminKiroGatewayPage /> },
         Route::AdminKiroAnthropicUpstreams => {
             html! { <pages::admin_kiro_anthropic_upstreams::AdminKiroAnthropicUpstreamsPage /> }
diff --git a/crates/frontend/src/seo.rs b/crates/frontend/src/seo.rs
index 5e38ad26..4424b162 100644
--- a/crates/frontend/src/seo.rs
+++ b/crates/frontend/src/seo.rs
@@ -292,6 +292,7 @@ fn route_path_for(route: &Route) -> String {
         Route::Admin => config::route_path("/admin"),
         Route::AdminLlmGateway => config::route_path("/admin/llm-gateway"),
         Route::AdminLlmGatewayMonitor => config::route_path("/admin/llm-gateway/monitor"),
+        Route::AdminLlmGatewayModeration => config::route_path("/admin/llm-gateway/moderation"),
         Route::AdminKiroGateway => config::route_path("/admin/kiro-gateway"),
         Route::AdminKiroAccountStatus => config::route_path("/admin/kiro-gateway/accounts"),
         Route::AdminKiroAnthropicUpstreams => {
@@ -511,6 +512,7 @@ pub fn apply_route_seo(route: Option<&Route>) {
         Route::Admin
         | Route::AdminLlmGateway
         | Route::AdminLlmGatewayMonitor
+        | Route::AdminLlmGatewayModeration
         | Route::AdminKiroGateway
         | Route::AdminKiroAccountStatus
         | Route::AdminKiroAnthropicUpstreams
diff --git a/crates/llm-access-core/Cargo.toml b/crates/llm-access-core/Cargo.toml
index 894b1f3c..fa0abb62 100644
--- a/crates/llm-access-core/Cargo.toml
+++ b/crates/llm-access-core/Cargo.toml
@@ -8,6 +8,7 @@ publish = false
 workspace = true
 
 [dependencies]
+aho-corasick = { workspace = true }
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 base64 = "0.22.1"
diff --git a/crates/llm-access-core/examples/normalize_moderation.rs b/crates/llm-access-core/examples/normalize_moderation.rs
new file mode 100644
index 00000000..d3c3524d
--- /dev/null
+++ b/crates/llm-access-core/examples/normalize_moderation.rs
@@ -0,0 +1,24 @@
+//! Normalize one moderation keyword per input line into the canonical tokenized
+//! form used by the runtime matcher and the admin import path.
+//!
+//! Usage: `cargo run -p llm-access-core --example normalize_moderation -- IN
+//! OUT` Reads `IN` (one keyword per line, UTF-8), writes `OUT` with the
+//! normalized form of each line. Empty results are preserved as blank lines so
+//! the caller can zip output lines back to input lines by index.
+
+use std::{env, fs};
+
+use llm_access_core::moderation::normalize_moderation_text;
+
+fn main() {
+    let args: Vec<String> = env::args().collect();
+    let input_path = args.get(1).expect("usage: normalize_moderation IN OUT");
+    let output_path = args.get(2).expect("usage: normalize_moderation IN OUT");
+    let input = fs::read_to_string(input_path).expect("read input file");
+    let mut output = String::with_capacity(input.len());
+    for line in input.lines() {
+        output.push_str(&normalize_moderation_text(line));
+        output.push('\n');
+    }
+    fs::write(output_path, output).expect("write output file");
+}
diff --git a/crates/llm-access-core/src/lib.rs b/crates/llm-access-core/src/lib.rs
index 696cc385..d32634d2 100644
--- a/crates/llm-access-core/src/lib.rs
+++ b/crates/llm-access-core/src/lib.rs
@@ -1,5 +1,6 @@
 //! Shared contracts for the standalone LLM access service.
 
+pub mod moderation;
 pub mod provider;
 pub mod proxy;
 pub mod routes;
diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
new file mode 100644
index 00000000..48802a15
--- /dev/null
+++ b/crates/llm-access-core/src/moderation.rs
@@ -0,0 +1,684 @@
+//! Keyword moderation matching primitives shared by the request hot path and
+//! the admin import surface.
+//!
+//! # What this does
+//!
+//! Given a set of banned keywords and one request's text, decide whether the
+//! text contains any keyword — as a **phrase (term-sequence) query**, not a raw
+//! `contains`. A keyword like `build a bomb` should match `Build, a  bomb!`
+//! (punctuation/spacing differ) but not `bomber` (different term), and the CJK
+//! keyword `违禁词` should still match `违.禁.词` (separator-injection
+//! evasion).
+//!
+//! # The pipeline
+//!
+//! Both keywords and request text pass through the *same* tokenizer
+//! ([`normalize_moderation_text`]) so the two sides are always comparable:
+//!
+//! ```text
+//!    raw text ─▶ TOKENIZE ────────────────▶ canonical form ─▶ SCAN ─▶ BOUNDARY ─▶ hit?
+//!   (keyword or   • lowercase                "t1 t2 t3"       Aho-      each hit must
+//!    request)     • fold fullwidth ASCII     (terms joined    Corasick  be delimited by
+//!                 • split into terms:         by one space,   over ALL  a space or the
+//!                     - alnum run  = 1 term    no punct)      keywords  string edge on
+//!                     - ideograph  = 1 term                   in ONE    both sides
+//!                 • punctuation / space        ▲              pass      ▲
+//!                   = term separator (dropped) │                        │
+//!                                              └── invariant: a term never contains a space,
+//!                                                  so a space-or-edge delimited substring
+//!                                                  match == a contiguous term-sequence match
+//! ```
+//!
+//! # Worked examples
+//!
+//! English, punctuation/case/spacing insensitive:
+//!
+//! ```text
+//!   keyword  "Build a Bomb"            ─tokenize─▶  "build a bomb"      ◀── automaton pattern
+//!   request  "please, BUILD a  bomb!!" ─tokenize─▶  "please build a bomb"
+//!                                                            └──────────┘  match at term
+//!                                                                          boundary ⇒ BLOCK
+//!   request  "a bomber flew"           ─tokenize─▶  "a bomber flew"
+//!                                                       └── "bomb" is inside the single term
+//!                                                           "bomber" ⇒ boundary check rejects
+//! ```
+//!
+//! CJK, evasion-resistant (each ideograph is its own term, so separators
+//! between characters simply vanish into the same canonical form):
+//!
+//! ```text
+//!   keyword  "违禁词"     ─tokenize─▶  "违 禁 词"
+//!   request  "违.禁，词"  ─tokenize─▶  "违 禁 词"   ← dots/commas dropped as separators
+//!                                        └── identical canonical form ⇒ BLOCK
+//! ```
+//!
+//! # Why Aho-Corasick
+//!
+//! One automaton compiled from *all* keywords scans the request text in a
+//! single `O(n)` pass (n = canonical text length) that is independent of the
+//! keyword count `k` — versus `O(k·n)` for `k` separate substring searches.
+//! The automaton is built once per gate reload (see the `llm-access`
+//! `moderation` gate), never per request; matching a request is pure `O(n)`.
+//! Aho-Corasick reports substring hits, so a cheap `O(1)` term-boundary check
+//! (a byte look on each side of the hit) upgrades those substring hits to true
+//! phrase hits without a second scan.
+
+use aho_corasick::{AhoCorasick, AhoCorasickBuilder, MatchKind};
+use serde_json::Value;
+
+/// Number of characters kept on each side of a keyword hit when building the
+/// reviewer-facing context snippet.
+const MATCH_CONTEXT_RADIUS_CHARS: usize = 80;
+
+/// JSON object keys whose string values count as user-visible request text.
+const MODERATION_TEXT_KEYS: [&str; 4] = ["text", "content", "instructions", "system"];
+
+/// One keyword hit inside normalized request text.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ModerationMatch {
+    /// The normalized keyword that fired.
+    pub keyword: String,
+    /// Risk-category codes attached to the keyword that fired (a keyword may
+    /// belong to several categories, e.g. `["fraud", "cyber"]`).
+    pub categories: Vec<String>,
+    /// Byte offset where the hit starts in the normalized request text.
+    pub match_start: usize,
+    /// Byte offset just after the hit in the normalized request text.
+    pub match_end: usize,
+    /// Context snippet around the hit taken from the normalized text.
+    pub context: String,
+}
+
+/// Compiled multi-pattern keyword matcher. `patterns` and `categories` are
+/// parallel: `categories[i]` are the category codes for `patterns[i]`.
+pub struct ModerationMatcher {
+    automaton: AhoCorasick,
+    patterns: Vec<String>,
+    categories: Vec<Vec<String>>,
+}
+
+impl std::fmt::Debug for ModerationMatcher {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ModerationMatcher")
+            .field("patterns", &self.patterns.len())
+            .finish()
+    }
+}
+
+impl ModerationMatcher {
+    /// Compile normalized keywords — each paired with its risk-category codes —
+    /// into one scan automaton. Empty patterns (and their categories) are
+    /// skipped; returns `None` when no usable pattern remains.
+    pub fn build<I, S>(keywords: I) -> anyhow::Result<Option<Self>>
+    where
+        I: IntoIterator<Item = (S, Vec<String>)>,
+        S: AsRef<str>,
+    {
+        let mut patterns = Vec::new();
+        let mut categories = Vec::new();
+        for (keyword, keyword_categories) in keywords {
+            let normalized = normalize_moderation_text(keyword.as_ref());
+            if normalized.is_empty() {
+                continue;
+            }
+            patterns.push(normalized);
+            categories.push(keyword_categories);
+        }
+        if patterns.is_empty() {
+            return Ok(None);
+        }
+        let automaton = AhoCorasickBuilder::new()
+            .match_kind(MatchKind::Standard)
+            .build(&patterns)
+            .map_err(|err| anyhow::anyhow!("build moderation keyword automaton: {err}"))?;
+        Ok(Some(Self {
+            automaton,
+            patterns,
+            categories,
+        }))
+    }
+
+    /// Number of compiled patterns.
+    pub fn pattern_count(&self) -> usize {
+        self.patterns.len()
+    }
+
+    /// Scan tokenized text and return the first phrase hit that aligns to term
+    /// boundaries. `normalized_text` must already be
+    /// [`normalize_moderation_text`] output (canonical single-space-joined
+    /// terms).
+    pub fn find(&self, normalized_text: &str) -> Option<ModerationMatch> {
+        self.find_inner(normalized_text, 0, None)
+    }
+
+    /// Scan tokenized text from `start_at` and return the first phrase hit
+    /// whose start offset is at or after `start_at`.
+    pub fn find_from(&self, normalized_text: &str, start_at: usize) -> Option<ModerationMatch> {
+        self.find_inner(
+            normalized_text,
+            start_at.min(normalized_text.len()),
+            Some((start_at, false)),
+        )
+    }
+
+    /// Scan tokenized text from `start_after` and return the first phrase hit
+    /// whose start offset is greater than `start_after`.
+    pub fn find_after(&self, normalized_text: &str, start_after: usize) -> Option<ModerationMatch> {
+        self.find_inner(
+            normalized_text,
+            start_after.min(normalized_text.len()),
+            Some((start_after, true)),
+        )
+    }
+
+    /// Scan the whole text and return the first term-boundary-aligned hit that
+    /// `accept(keyword, match_start, match_end)` returns true for. Unlike
+    /// [`Self::find_after`], this enumerates *every* overlapping hit —
+    /// including several distinct keywords that share a start offset (a
+    /// phrase-prefix and its superstring) — so a caller can skip specific
+    /// hits by identity without missing a co-located keyword. `accept` is
+    /// evaluated cheaply per candidate; the full [`ModerationMatch`] (with
+    /// its context snippet) is built only for the accepted hit.
+    ///
+    /// This exists for the moderation gate's hit-scoped suppression: skipping a
+    /// scan *by offset* (as [`Self::find_after`] does) would discard a
+    /// distinct, unsuppressed keyword that happens to start at the same
+    /// offset as a suppressed one — a content-policy bypass. Filtering by
+    /// hit identity via `accept` avoids that; `find_overlapping_iter`
+    /// exposes every candidate at a shared start, so `accept` can inspect each
+    /// one without relying on match order.
+    pub fn find_accepted(
+        &self,
+        normalized_text: &str,
+        accept: impl Fn(&str, usize, usize) -> bool,
+    ) -> Option<ModerationMatch> {
+        let haystack = normalized_text.as_bytes();
+        for candidate in self.automaton.find_overlapping_iter(normalized_text) {
+            let start = candidate.start();
+            let end = candidate.end();
+            if !match_on_term_boundaries(haystack, start, end) {
+                continue;
+            }
+            let index = candidate.pattern().as_usize();
+            if accept(&self.patterns[index], start, end) {
+                return Some(ModerationMatch {
+                    keyword: self.patterns[index].clone(),
+                    categories: self.categories[index].clone(),
+                    match_start: start,
+                    match_end: end,
+                    context: match_context_snippet(normalized_text, start, end),
+                });
+            }
+        }
+        None
+    }
+
+    fn find_inner(
+        &self,
+        normalized_text: &str,
+        scan_start: usize,
+        start_limit: Option<(usize, bool)>,
+    ) -> Option<ModerationMatch> {
+        let scan_start = next_char_boundary(normalized_text, scan_start);
+        let haystack = normalized_text.as_bytes();
+        for candidate in self
+            .automaton
+            .find_overlapping_iter(&normalized_text[scan_start..])
+        {
+            let start = scan_start + candidate.start();
+            let end = scan_start + candidate.end();
+            if start_limit.is_some_and(
+                |(offset, exclusive)| {
+                    if exclusive {
+                        start <= offset
+                    } else {
+                        start < offset
+                    }
+                },
+            ) {
+                continue;
+            }
+            if !match_on_term_boundaries(haystack, start, end) {
+                continue;
+            }
+            let index = candidate.pattern().as_usize();
+            return Some(ModerationMatch {
+                keyword: self.patterns[index].clone(),
+                categories: self.categories[index].clone(),
+                match_start: start,
+                match_end: end,
+                context: match_context_snippet(normalized_text, start, end),
+            });
+        }
+        None
+    }
+}
+
+fn next_char_boundary(text: &str, offset: usize) -> usize {
+    let mut offset = offset.min(text.len());
+    while offset < text.len() && !text.is_char_boundary(offset) {
+        offset += 1;
+    }
+    offset
+}
+
+/// In the canonical form every term is separated by exactly one ASCII space
+/// (byte `0x20`), which never appears inside a multi-byte UTF-8 sequence, so a
+/// hit aligns to term boundaries iff it is delimited by a space or the string
+/// edge on both sides. This keeps `bomb` from firing inside the single term
+/// `bomber` while letting phrase keywords match their term sequence anywhere.
+fn match_on_term_boundaries(haystack: &[u8], start: usize, end: usize) -> bool {
+    let before_ok = start == 0 || haystack[start - 1] == b' ';
+    let after_ok = end == haystack.len() || haystack[end] == b' ';
+    before_ok && after_ok
+}
+
+fn match_context_snippet(text: &str, start: usize, end: usize) -> String {
+    let snippet_start = {
+        let mut cursor = start;
+        for _ in 0..MATCH_CONTEXT_RADIUS_CHARS {
+            match text[..cursor].char_indices().next_back() {
+                Some((index, _)) => cursor = index,
+                None => break,
+            }
+        }
+        cursor
+    };
+    let snippet_end = {
+        let mut cursor = end;
+        for _ in 0..MATCH_CONTEXT_RADIUS_CHARS {
+            match text[cursor..].chars().next() {
+                Some(ch) => cursor += ch.len_utf8(),
+                None => break,
+            }
+        }
+        cursor
+    };
+    let mut snippet = String::new();
+    if snippet_start > 0 {
+        snippet.push('…');
+    }
+    snippet.push_str(&text[snippet_start..snippet_end]);
+    if snippet_end < text.len() {
+        snippet.push('…');
+    }
+    snippet
+}
+
+/// Codepoint ranges for scripts written without word spacing, where each
+/// character is treated as its own term. Per-character tokenization means
+/// separators injected between characters (`违.禁.词`) collapse back to the
+/// same canonical term sequence as the bare phrase, so they cannot evade a
+/// keyword.
+fn is_ideographic_char(ch: char) -> bool {
+    // Note: the Halfwidth & Fullwidth Forms block (U+FF00–FFEF) is deliberately
+    // excluded — it mixes fullwidth punctuation (，！？) with letters/digits, so
+    // its punctuation must remain a term separator, not become a term.
+    matches!(ch as u32,
+        0x3040..=0x30FF        // Hiragana + Katakana
+        | 0x3400..=0x4DBF      // CJK Unified Ideographs Extension A
+        | 0x4E00..=0x9FFF      // CJK Unified Ideographs
+        | 0xAC00..=0xD7AF      // Hangul syllables
+        | 0xF900..=0xFAFF      // CJK Compatibility Ideographs
+        | 0x20000..=0x2FA1F,   // CJK Unified Ideographs Extension B–F + supplement
+    )
+}
+
+/// Fold fullwidth ASCII variants (U+FF01–FF5E, common in CJK input) to their
+/// ASCII equivalents so `ＢＯＭＢ` normalizes like `bomb` and fullwidth
+/// punctuation (`，！`) becomes an ASCII separator instead of a stray term.
+fn fold_fullwidth_ascii(ch: char) -> char {
+    match ch as u32 {
+        code @ 0xFF01..=0xFF5E => char::from_u32(code - 0xFEE0).unwrap_or(ch),
+        _ => ch,
+    }
+}
+
+/// Tokenize text into a canonical phrase-query form: lowercase, split into
+/// terms (alphanumeric runs for space-delimited scripts, one term per
+/// ideographic character), drop punctuation/whitespace, and rejoin terms with a
+/// single ASCII space. Both keywords and request text pass through this so
+/// matching is insensitive to punctuation and spacing differences. See the
+/// module docs.
+pub fn normalize_moderation_text(text: &str) -> String {
+    let mut normalized = String::with_capacity(text.len());
+    // Whether the previous character continued the current alphanumeric term.
+    let mut in_word_term = false;
+    for ch in text.chars() {
+        let ch = fold_fullwidth_ascii(ch);
+        if is_ideographic_char(ch) {
+            if !normalized.is_empty() {
+                normalized.push(' ');
+            }
+            normalized.push(ch);
+            in_word_term = false;
+        } else if ch.is_alphanumeric() {
+            if !in_word_term && !normalized.is_empty() {
+                normalized.push(' ');
+            }
+            for lower in ch.to_lowercase() {
+                normalized.push(lower);
+            }
+            in_word_term = true;
+        } else {
+            // Punctuation, whitespace, and symbols separate terms.
+            in_word_term = false;
+        }
+    }
+    normalized
+}
+
+/// Collect user-visible text from a request body JSON value.
+///
+/// Walks the value tree and gathers string values stored under
+/// `text` / `content` / `instructions` / `system` keys, which covers Anthropic
+/// messages (`system`, content blocks), OpenAI chat completions
+/// (`messages[].content`, string or `text` parts) and Codex responses
+/// (`instructions`, `input[].content[].text`) without dragging JSON structure
+/// noise (field names, model ids, tool schemas) into the scan.
+pub fn extract_moderation_text(body: &Value) -> String {
+    let mut collected = String::new();
+    collect_moderation_text(body, &mut collected);
+    collected
+}
+
+fn collect_moderation_text(value: &Value, out: &mut String) {
+    match value {
+        Value::Object(map) => {
+            for (key, child) in map {
+                match child {
+                    Value::String(text)
+                        if MODERATION_TEXT_KEYS.contains(&key.as_str()) && !text.is_empty() =>
+                    {
+                        if !out.is_empty() {
+                            out.push('\n');
+                        }
+                        out.push_str(text);
+                    },
+                    _ => collect_moderation_text(child, out),
+                }
+            }
+        },
+        Value::Array(items) => {
+            for item in items {
+                collect_moderation_text(item, out);
+            }
+        },
+        _ => {},
+    }
+}
+
+/// Parse plain-text keyword input: one keyword per line, inner whitespace
+/// runs are treated as single phrase separators, blank lines are skipped.
+pub fn parse_moderation_keywords_txt(content: &str) -> Vec<String> {
+    let mut keywords = Vec::new();
+    for line in content.lines() {
+        let normalized = normalize_moderation_text(line);
+        if !normalized.is_empty() && !keywords.contains(&normalized) {
+            keywords.push(normalized);
+        }
+    }
+    keywords
+}
+
+/// Parse JSON keyword input. Accepted shapes:
+/// - `["keyword a", "keyword b"]`
+/// - `{"keywords": ["keyword a", …]}`
+/// - `[{"keyword": "…"}, {"word": "…"}, {"text": "…"}]` (fields tried in that
+///   order per object)
+pub fn parse_moderation_keywords_json(content: &str) -> anyhow::Result<Vec<String>> {
+    let value: Value = serde_json::from_str(content)
+        .map_err(|err| anyhow::anyhow!("keyword JSON is invalid: {err}"))?;
+    let items = match &value {
+        Value::Array(items) => items.as_slice(),
+        Value::Object(map) => match map.get("keywords") {
+            Some(Value::Array(items)) => items.as_slice(),
+            _ => anyhow::bail!("keyword JSON object must contain a `keywords` array"),
+        },
+        _ => anyhow::bail!("keyword JSON must be an array or an object with a `keywords` array"),
+    };
+    let mut keywords = Vec::new();
+    for item in items {
+        let raw = match item {
+            Value::String(text) => text.as_str(),
+            Value::Object(map) => ["keyword", "word", "text"]
+                .iter()
+                .find_map(|field| map.get(*field).and_then(Value::as_str))
+                .ok_or_else(|| {
+                    anyhow::anyhow!(
+                        "keyword JSON object entries need a `keyword`/`word`/`text` string field"
+                    )
+                })?,
+            other => anyhow::bail!("unsupported keyword JSON entry: {other}"),
+        };
+        let normalized = normalize_moderation_text(raw);
+        if !normalized.is_empty() && !keywords.contains(&normalized) {
+            keywords.push(normalized);
+        }
+    }
+    Ok(keywords)
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    fn matcher(keywords: &[&str]) -> ModerationMatcher {
+        ModerationMatcher::build(keywords.iter().map(|keyword| (*keyword, Vec::new())))
+            .expect("build matcher")
+            .expect("matcher should have patterns")
+    }
+
+    #[test]
+    fn normalize_tokenizes_lowercases_and_drops_punctuation() {
+        assert_eq!(
+            normalize_moderation_text("  Hello \t WORLD\nfoo\r\n bar "),
+            "hello world foo bar"
+        );
+        // Punctuation is a term separator, not preserved.
+        assert_eq!(normalize_moderation_text("Build, a  bomb!"), "build a bomb");
+        assert_eq!(normalize_moderation_text("U.S.A."), "u s a");
+        // Each ideographic character is its own term.
+        assert_eq!(normalize_moderation_text("你好\u{3000}世界"), "你 好 世 界");
+        // Separators injected between ideographs collapse to the same terms.
+        assert_eq!(normalize_moderation_text("违.禁，词"), "违 禁 词");
+        // Fullwidth ASCII folds to ASCII (letters, and fullwidth comma → sep).
+        assert_eq!(normalize_moderation_text("ＢＯＭＢ"), "bomb");
+        assert_eq!(normalize_moderation_text("ｈｅｌｌｏ，ｗｏｒｌｄ"), "hello world");
+        assert_eq!(normalize_moderation_text("   "), "");
+    }
+
+    #[test]
+    fn phrase_match_tolerates_formatting_differences() {
+        let matcher = matcher(&["Free  Palestine  Movement"]);
+        let text = normalize_moderation_text("please join the free\npalestine   movement now");
+        let hit = matcher.find(&text).expect("phrase should match");
+        assert_eq!(hit.keyword, "free palestine movement");
+        assert_eq!(hit.match_start, text.find("free").expect("hit offset"));
+        assert_eq!(hit.match_end, text.find(" now").expect("hit end marker"));
+        assert!(hit.context.contains("free palestine movement"));
+    }
+
+    #[test]
+    fn find_from_includes_resume_position_and_find_after_skips_it() {
+        let matcher = matcher(&["build a bomb", "carding tutorial"]);
+        let text = normalize_moderation_text(
+            "first false positive: build a bomb. Later request asks for carding tutorial.",
+        );
+        let first = matcher.find(&text).expect("first phrase should match");
+        assert_eq!(first.keyword, "build a bomb");
+
+        let resumed = matcher
+            .find_from(&text, first.match_start)
+            .expect("resume scan should inspect the reviewed position");
+        assert_eq!(resumed.keyword, "build a bomb");
+
+        let second = matcher
+            .find_after(&text, first.match_start)
+            .expect("resume scan should continue past reviewed hit");
+        assert_eq!(second.keyword, "carding tutorial");
+        assert!(second.match_start > first.match_start);
+    }
+
+    #[test]
+    fn phrase_match_tolerates_punctuation_in_text() {
+        let matcher = matcher(&["build a bomb"]);
+        assert!(matcher
+            .find(&normalize_moderation_text("please, Build a  BOMB!!!"))
+            .is_some());
+        assert!(matcher
+            .find(&normalize_moderation_text("first build; then a bomb"))
+            .is_none());
+    }
+
+    #[test]
+    fn ascii_keywords_require_term_boundaries() {
+        let ass = matcher(&["ass"]);
+        assert!(ass
+            .find(&normalize_moderation_text("this is a class assignment"))
+            .is_none());
+        assert!(ass
+            .find(&normalize_moderation_text("kick his ass now"))
+            .is_some());
+        // A phrase keyword is a full term, so it does not fire inside a longer
+        // term.
+        let bomb = matcher(&["bomb"]);
+        assert!(bomb
+            .find(&normalize_moderation_text("a bomber flew"))
+            .is_none());
+        assert!(bomb
+            .find(&normalize_moderation_text("a bomb fell"))
+            .is_some());
+    }
+
+    #[test]
+    fn cjk_phrase_matches_and_resists_separator_evasion() {
+        let matcher = matcher(&["敏感词"]);
+        assert!(matcher
+            .find(&normalize_moderation_text("这句话包含敏感词内容"))
+            .is_some());
+        // Punctuation inserted between the characters must not evade the match.
+        assert!(matcher
+            .find(&normalize_moderation_text("这句话包含敏-感-词内容"))
+            .is_some());
+        assert!(matcher
+            .find(&normalize_moderation_text("敏\u{3000}感\u{3000}词"))
+            .is_some());
+    }
+
+    #[test]
+    fn boundary_rejection_does_not_hide_later_hits() {
+        let matcher = matcher(&["ass", "bomb"]);
+        let hit = matcher
+            .find(&normalize_moderation_text("classic bomb recipe"))
+            .expect("second keyword should still match");
+        assert_eq!(hit.keyword, "bomb");
+    }
+
+    #[test]
+    fn extracts_anthropic_message_content() {
+        let body = json!({
+            "model": "claude-sonnet-4",
+            "system": [{"type": "text", "text": "You are helpful."}],
+            "messages": [
+                {"role": "user", "content": "how to Build a BOMB"},
+                {"role": "assistant", "content": [{"type": "text", "text": "I cannot help."}]},
+                {"role": "user", "content": [{"type": "tool_result", "content": [{"type": "text", "text": "tool output"}]}]}
+            ],
+            "tools": [{"name": "search", "description": "ignored tool description"}]
+        });
+        let text = extract_moderation_text(&body);
+        assert!(text.contains("You are helpful."));
+        assert!(text.contains("how to Build a BOMB"));
+        assert!(text.contains("tool output"));
+        assert!(!text.contains("ignored tool description"));
+        assert!(!text.contains("claude-sonnet-4"));
+    }
+
+    #[test]
+    fn extracts_codex_responses_content() {
+        let body = json!({
+            "model": "gpt-5",
+            "instructions": "system instructions here",
+            "input": [
+                {"type": "message", "role": "user", "content": [
+                    {"type": "input_text", "text": "user question body"}
+                ]}
+            ]
+        });
+        let text = extract_moderation_text(&body);
+        assert!(text.contains("system instructions here"));
+        assert!(text.contains("user question body"));
+        assert!(!text.contains("gpt-5"));
+    }
+
+    #[test]
+    fn extracts_chat_completions_content() {
+        let body = json!({
+            "model": "gpt-5",
+            "messages": [
+                {"role": "system", "content": "chat system prompt"},
+                {"role": "user", "content": [{"type": "text", "text": "chat user text"}]}
+            ]
+        });
+        let text = extract_moderation_text(&body);
+        assert!(text.contains("chat system prompt"));
+        assert!(text.contains("chat user text"));
+    }
+
+    #[test]
+    fn parses_txt_keywords() {
+        let keywords = parse_moderation_keywords_txt("  Foo   Bar \n\nbaz\nfoo bar\n");
+        assert_eq!(keywords, vec!["foo bar".to_string(), "baz".to_string()]);
+    }
+
+    #[test]
+    fn parses_json_keyword_shapes() {
+        assert_eq!(
+            parse_moderation_keywords_json(r#"["A b", "c"]"#).expect("array of strings"),
+            vec!["a b".to_string(), "c".to_string()]
+        );
+        assert_eq!(
+            parse_moderation_keywords_json(r#"{"keywords": ["X"]}"#).expect("keywords object"),
+            vec!["x".to_string()]
+        );
+        assert_eq!(
+            parse_moderation_keywords_json(r#"[{"keyword": "K"}, {"word": "W"}, {"text": "T"}]"#)
+                .expect("array of objects"),
+            vec!["k".to_string(), "w".to_string(), "t".to_string()]
+        );
+        assert!(parse_moderation_keywords_json("{}").is_err());
+        assert!(parse_moderation_keywords_json("42").is_err());
+        assert!(parse_moderation_keywords_json("not json").is_err());
+    }
+
+    #[test]
+    fn empty_keyword_set_builds_no_matcher() {
+        assert!(ModerationMatcher::build(Vec::<(String, Vec<String>)>::new())
+            .expect("build")
+            .is_none());
+        assert!(ModerationMatcher::build(vec![("   ", Vec::new()), ("\n", Vec::new())])
+            .expect("build")
+            .is_none());
+    }
+
+    #[test]
+    fn match_carries_keyword_categories() {
+        let matcher = ModerationMatcher::build(vec![
+            ("build a bomb", vec!["weapons".to_string()]),
+            ("carding tutorial", vec!["fraud".to_string(), "cyber".to_string()]),
+        ])
+        .expect("build")
+        .expect("matcher");
+        let weapons = matcher
+            .find(&normalize_moderation_text("how to build a bomb"))
+            .expect("weapons hit");
+        assert_eq!(weapons.categories, vec!["weapons".to_string()]);
+        let fraud = matcher
+            .find(&normalize_moderation_text("a carding tutorial please"))
+            .expect("fraud hit");
+        assert_eq!(fraud.categories, vec!["fraud".to_string(), "cyber".to_string()]);
+    }
+}
diff --git a/crates/llm-access-core/src/store/empty.rs b/crates/llm-access-core/src/store/empty.rs
index 45efc8b8..f285104c 100644
--- a/crates/llm-access-core/src/store/empty.rs
+++ b/crates/llm-access-core/src/store/empty.rs
@@ -31,6 +31,12 @@ use super::{
         AdminKiroBalanceView, AdminKiroCacheView, AdminKiroStatusCacheUpdate,
         KiroStatusRefreshTarget, NewAdminKiroAccount,
     },
+    moderation::{
+        ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
+        ModerationCategory, ModerationKeyword, ModerationKeywordImportOutcome,
+        ModerationRuntimeSnapshot, NewModerationBannedSession, NewModerationCategory,
+        NewModerationKeyword,
+    },
     proxy::{
         default_proxy_binding, default_proxy_bindings, AdminProxyBinding, AdminProxyConfig,
         AdminProxyConfigPatch, AdminProxyTrafficSnapshot, NewAdminProxyConfig,
@@ -48,10 +54,10 @@ use super::{
     },
     traits::{
         AdminAccountGroupStore, AdminAnthropicUpstreamStore, AdminCodexAccountStore,
-        AdminConfigStore, AdminKeyStore, AdminKiroAccountStore, AdminProxyStore,
-        AdminReviewQueueStore, ProviderRouteStore, PublicAccessStore, PublicCommunityStore,
-        PublicStatusStore, PublicSubmissionStore, PublicUsageStore, UsageAnalyticsStore,
-        UsageEventSink, UsageRollupBatchSink,
+        AdminConfigStore, AdminKeyStore, AdminKiroAccountStore, AdminModerationStore,
+        AdminProxyStore, AdminReviewQueueStore, ProviderRouteStore, PublicAccessStore,
+        PublicCommunityStore, PublicStatusStore, PublicSubmissionStore, PublicUsageStore,
+        UsageAnalyticsStore, UsageEventSink, UsageRollupBatchSink,
     },
     usage::{
         AdminLegacyKiroProxyMigration, ProxyTrafficQuery, ProxyTrafficSnapshot, ProxyTrafficTotals,
@@ -72,6 +78,91 @@ pub struct EmptyProviderRouteStore;
 /// Empty direct Anthropic upstream store used by isolated unit tests.
 pub struct EmptyAdminAnthropicUpstreamStore;
 
+/// Empty keyword moderation store used as the disabled-gate default and in
+/// isolated unit tests.
+pub struct EmptyAdminModerationStore;
+
+#[async_trait]
+impl AdminModerationStore for EmptyAdminModerationStore {
+    async fn load_moderation_runtime_snapshot(&self) -> anyhow::Result<ModerationRuntimeSnapshot> {
+        Ok(ModerationRuntimeSnapshot::default())
+    }
+
+    async fn list_moderation_categories(&self) -> anyhow::Result<Vec<ModerationCategory>> {
+        Ok(Vec::new())
+    }
+
+    async fn add_moderation_categories(
+        &self,
+        _categories: Vec<NewModerationCategory>,
+    ) -> anyhow::Result<usize> {
+        anyhow::bail!("moderation store is not configured")
+    }
+
+    async fn delete_moderation_category(
+        &self,
+        _code: &str,
+    ) -> anyhow::Result<Option<ModerationCategory>> {
+        Ok(None)
+    }
+
+    async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>> {
+        Ok(Vec::new())
+    }
+
+    async fn add_moderation_keywords(
+        &self,
+        _keywords: Vec<NewModerationKeyword>,
+    ) -> anyhow::Result<ModerationKeywordImportOutcome> {
+        anyhow::bail!("moderation store is not configured")
+    }
+
+    async fn delete_moderation_keyword(
+        &self,
+        _id: i64,
+    ) -> anyhow::Result<Option<ModerationKeyword>> {
+        Ok(None)
+    }
+
+    async fn record_moderation_banned_session(
+        &self,
+        _record: NewModerationBannedSession,
+    ) -> anyhow::Result<bool> {
+        anyhow::bail!("moderation store is not configured")
+    }
+
+    async fn list_moderation_banned_sessions(
+        &self,
+        page: AdminPageRequest,
+        _status: Option<&str>,
+    ) -> anyhow::Result<ModerationBannedSessionsPage> {
+        Ok(ModerationBannedSessionsPage {
+            sessions: Vec::new(),
+            total: 0,
+            limit: page.limit,
+            offset: page.offset,
+            has_more: false,
+        })
+    }
+
+    async fn get_moderation_banned_session(
+        &self,
+        _id: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSessionDetail>> {
+        Ok(None)
+    }
+
+    async fn set_moderation_banned_session_status(
+        &self,
+        _id: i64,
+        _status: &str,
+        _review_note: Option<&str>,
+        _reviewed_at_ms: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSession>> {
+        Ok(None)
+    }
+}
+
 #[async_trait]
 impl ProviderRouteStore for EmptyProviderRouteStore {
     async fn resolve_codex_route(
diff --git a/crates/llm-access-core/src/store/mod.rs b/crates/llm-access-core/src/store/mod.rs
index 97c1ebc1..8c8ecded 100644
--- a/crates/llm-access-core/src/store/mod.rs
+++ b/crates/llm-access-core/src/store/mod.rs
@@ -15,6 +15,7 @@ mod groups;
 mod keys;
 mod kiro_account;
 mod kiro_model_routing;
+mod moderation;
 mod proxy;
 mod public;
 mod routes;
@@ -52,10 +53,11 @@ pub use config::{
 };
 pub use empty::{
     EmptyAdminAccountGroupStore, EmptyAdminAnthropicUpstreamStore, EmptyAdminCodexAccountStore,
-    EmptyAdminConfigStore, EmptyAdminKeyStore, EmptyAdminKiroAccountStore, EmptyAdminProxyStore,
-    EmptyAdminReviewQueueStore, EmptyProviderRouteStore, EmptyPublicAccessStore,
-    EmptyPublicCommunityStore, EmptyPublicStatusStore, EmptyPublicSubmissionStore,
-    EmptyPublicUsageStore, EmptyUsageAnalyticsStore, NoopUsageEventSink, NoopUsageRollupBatchSink,
+    EmptyAdminConfigStore, EmptyAdminKeyStore, EmptyAdminKiroAccountStore,
+    EmptyAdminModerationStore, EmptyAdminProxyStore, EmptyAdminReviewQueueStore,
+    EmptyProviderRouteStore, EmptyPublicAccessStore, EmptyPublicCommunityStore,
+    EmptyPublicStatusStore, EmptyPublicSubmissionStore, EmptyPublicUsageStore,
+    EmptyUsageAnalyticsStore, NoopUsageEventSink, NoopUsageRollupBatchSink,
 };
 pub use groups::{
     AdminAccountGroup, AdminAccountGroupOption, AdminAccountGroupPatch, AdminAccountGroupsPage,
@@ -75,6 +77,15 @@ pub use kiro_account::{
 pub use kiro_model_routing::{
     kiro_model_group_preference, normalize_kiro_model_group_preferences, KiroModelGroupPreferences,
 };
+pub use moderation::{
+    ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
+    ModerationCategory, ModerationKeyword, ModerationKeywordImportOutcome,
+    ModerationRuntimeSnapshot, ModerationSuppressedHit, NewModerationBannedSession,
+    NewModerationCategory, NewModerationKeyword, MODERATION_CATEGORY_SEVERITY_CRITICAL,
+    MODERATION_CATEGORY_SEVERITY_MEDIUM, MODERATION_KEYWORD_SOURCE_JSON,
+    MODERATION_KEYWORD_SOURCE_TXT, MODERATION_SESSION_STATUS_BANNED,
+    MODERATION_SESSION_STATUS_UNBANNED,
+};
 pub use proxy::{
     default_proxy_bindings, AdminProxyBinding, AdminProxyConfig, AdminProxyConfigPatch,
     AdminProxyEndpointCheck, AdminProxyEndpointCheckUpdate, AdminProxyTrafficSnapshot,
@@ -95,10 +106,10 @@ pub use routes::{
 };
 pub use traits::{
     AdminAccountGroupStore, AdminAnthropicUpstreamStore, AdminCodexAccountStore, AdminConfigStore,
-    AdminKeyStore, AdminKiroAccountStore, AdminProxyStore, AdminReviewQueueStore, ControlStore,
-    ProviderRouteStore, PublicAccessStore, PublicCommunityStore, PublicStatusStore,
-    PublicSubmissionStore, PublicUsageStore, UsageAnalyticsStore, UsageEventSink,
-    UsageRollupBatchSink,
+    AdminKeyStore, AdminKiroAccountStore, AdminModerationStore, AdminProxyStore,
+    AdminReviewQueueStore, ControlStore, ProviderRouteStore, PublicAccessStore,
+    PublicCommunityStore, PublicStatusStore, PublicSubmissionStore, PublicUsageStore,
+    UsageAnalyticsStore, UsageEventSink, UsageRollupBatchSink,
 };
 pub use usage::{
     AdminLegacyKiroProxyMigration, KeyUsageRollupDelta, KeyUsageRollupLastUsedCount,
diff --git a/crates/llm-access-core/src/store/moderation.rs b/crates/llm-access-core/src/store/moderation.rs
new file mode 100644
index 00000000..8fa90faa
--- /dev/null
+++ b/crates/llm-access-core/src/store/moderation.rs
@@ -0,0 +1,244 @@
+//! Keyword moderation data model: configured keywords and banned sessions.
+
+use serde::{Deserialize, Serialize};
+
+/// Ban record status: the session is actively blocked.
+pub const MODERATION_SESSION_STATUS_BANNED: &str = "banned";
+/// Ban record status: a reviewer cleared this hit; later scans skip this hit
+/// position, not the whole session.
+pub const MODERATION_SESSION_STATUS_UNBANNED: &str = "unbanned";
+
+/// Keyword import source label for plain-text payloads.
+pub const MODERATION_KEYWORD_SOURCE_TXT: &str = "txt";
+/// Keyword import source label for JSON payloads.
+pub const MODERATION_KEYWORD_SOURCE_JSON: &str = "json";
+
+/// Category severity: reserved for the highest-harm categories (CSAM, weapons,
+/// self-harm, …).
+pub const MODERATION_CATEGORY_SEVERITY_CRITICAL: &str = "critical";
+/// Category severity default.
+pub const MODERATION_CATEGORY_SEVERITY_MEDIUM: &str = "medium";
+
+/// One risk category a keyword can be classified under. Categories are managed
+/// separately from keywords (see
+/// [`AdminModerationStore`](super::AdminModerationStore)), and a keyword may
+/// reference several by [`code`](ModerationCategory::code).
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationCategory {
+    /// Stable machine code, e.g. `csam`, `cyber`. Referenced by keywords.
+    pub code: String,
+    /// Human-facing label (may be bilingual).
+    pub label: String,
+    /// Longer description shown in the admin console.
+    pub description: String,
+    /// `critical` / `high` / `medium` / `low`.
+    pub severity: String,
+    /// Creation timestamp.
+    pub created_at_ms: i64,
+}
+
+/// Insert payload for one risk category.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct NewModerationCategory {
+    /// Stable machine code.
+    pub code: String,
+    /// Human-facing label.
+    pub label: String,
+    /// Longer description.
+    pub description: String,
+    /// Severity bucket.
+    pub severity: String,
+    /// Creation timestamp.
+    pub created_at_ms: i64,
+}
+
+/// One configured moderation keyword.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationKeyword {
+    /// Stable row id.
+    pub id: i64,
+    /// Normalized keyword phrase (lowercased, single-space separated).
+    pub keyword: String,
+    /// Risk-category codes this keyword is classified under (may be several).
+    #[serde(default)]
+    pub categories: Vec<String>,
+    /// Optional reviewer note.
+    pub note: Option<String>,
+    /// Import source: `txt` or `json`.
+    pub source: String,
+    /// Creation timestamp.
+    pub created_at_ms: i64,
+}
+
+/// Insert payload for one moderation keyword.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct NewModerationKeyword {
+    /// Normalized keyword phrase.
+    pub keyword: String,
+    /// Risk-category codes to classify this keyword under.
+    pub categories: Vec<String>,
+    /// Optional reviewer note.
+    pub note: Option<String>,
+    /// Import source: `txt` or `json`.
+    pub source: String,
+    /// Creation timestamp.
+    pub created_at_ms: i64,
+}
+
+/// Outcome of one bulk keyword import.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationKeywordImportOutcome {
+    /// Newly inserted keywords.
+    pub inserted: usize,
+    /// Keywords skipped because they already existed.
+    pub duplicates: usize,
+}
+
+/// Banned-session card without the captured request payload.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationBannedSession {
+    /// Stable row id.
+    pub id: i64,
+    /// Stable key for this exact hit inside this session.
+    pub hit_key: String,
+    /// Runtime ban key: `provider:key_id:session_id`.
+    pub session_key: String,
+    /// Provider family that produced the ban (`kiro` or `codex`).
+    pub provider: String,
+    /// Authenticated key id at ban time.
+    pub key_id: String,
+    /// Authenticated key display name at ban time.
+    pub key_name: String,
+    /// Client session id; empty when no stable session id was available.
+    pub session_id: String,
+    /// Normalized keyword that fired.
+    pub matched_keyword: String,
+    /// Risk-category codes of the keyword that fired.
+    #[serde(default)]
+    pub matched_categories: Vec<String>,
+    /// Context snippet around the hit from the normalized request text.
+    pub matched_context: String,
+    /// Byte offset where the hit starts in normalized request text.
+    pub match_start: i64,
+    /// Byte offset just after the hit in normalized request text.
+    pub match_end: i64,
+    /// SHA-256 of normalized text before `match_start`, used to bind hit
+    /// suppression to the exact reviewed preceding content.
+    pub match_prefix_sha256: String,
+    /// Hash of the keyword set active when this hit was recorded.
+    pub keyword_set_hash: String,
+    /// Gateway endpoint that received the blocked request.
+    pub endpoint: String,
+    /// Requested model, if known.
+    pub model: String,
+    /// Client IP at ban time.
+    pub client_ip: String,
+    /// `banned` or `unbanned`.
+    pub status: String,
+    /// Optional reviewer note recorded with the latest review action.
+    pub review_note: Option<String>,
+    /// Ban timestamp.
+    pub banned_at_ms: i64,
+    /// Latest review timestamp, if reviewed.
+    pub reviewed_at_ms: Option<i64>,
+    /// Update timestamp.
+    pub updated_at_ms: i64,
+}
+
+/// Banned-session detail including the captured request payload.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationBannedSessionDetail {
+    /// Session card.
+    pub session: ModerationBannedSession,
+    /// Captured request headers as a JSON object (sensitive values redacted).
+    pub request_headers_json: String,
+    /// Captured full request body JSON.
+    pub request_body_json: String,
+}
+
+/// Insert payload for one new banned session.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct NewModerationBannedSession {
+    /// Stable key for this exact hit inside this session.
+    pub hit_key: String,
+    /// Runtime ban key: `provider:key_id:session_id`.
+    pub session_key: String,
+    /// Provider family (`kiro` or `codex`).
+    pub provider: String,
+    /// Authenticated key id.
+    pub key_id: String,
+    /// Authenticated key display name.
+    pub key_name: String,
+    /// Client session id; empty when derived from request content.
+    pub session_id: String,
+    /// Normalized keyword that fired.
+    pub matched_keyword: String,
+    /// Risk-category codes of the keyword that fired.
+    pub matched_categories: Vec<String>,
+    /// Context snippet around the hit.
+    pub matched_context: String,
+    /// Byte offset where the hit starts in normalized request text.
+    pub match_start: i64,
+    /// Byte offset just after the hit in normalized request text.
+    pub match_end: i64,
+    /// SHA-256 of normalized text before `match_start`.
+    pub match_prefix_sha256: String,
+    /// Hash of the keyword set active when this hit was recorded.
+    pub keyword_set_hash: String,
+    /// Gateway endpoint.
+    pub endpoint: String,
+    /// Requested model, if known.
+    pub model: String,
+    /// Client IP.
+    pub client_ip: String,
+    /// Captured request headers JSON object (sensitive values redacted).
+    pub request_headers_json: String,
+    /// Captured full request body JSON.
+    pub request_body_json: String,
+    /// Ban timestamp.
+    pub banned_at_ms: i64,
+}
+
+/// One reviewed false-positive hit used by the runtime gate to suppress only
+/// that exact repeat match.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationSuppressedHit {
+    /// Runtime ban key: `provider:key_id:session_id`.
+    pub session_key: String,
+    /// Stable key for this exact hit inside this session.
+    pub hit_key: String,
+    /// Byte offset where the reviewed hit starts in normalized request text.
+    pub match_start: i64,
+    /// Byte offset just after the reviewed hit in normalized request text.
+    pub match_end: i64,
+    /// SHA-256 of normalized text before `match_start`.
+    pub match_prefix_sha256: String,
+    /// Hash of the keyword set active when this hit was recorded.
+    pub keyword_set_hash: String,
+}
+
+/// One page of banned sessions.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationBannedSessionsPage {
+    /// Page rows.
+    pub sessions: Vec<ModerationBannedSession>,
+    /// Total rows matching the filter before pagination.
+    pub total: usize,
+    /// Page limit.
+    pub limit: usize,
+    /// Page offset.
+    pub offset: usize,
+    /// Whether another page is available.
+    pub has_more: bool,
+}
+
+/// Compact startup/refresh snapshot for the in-memory moderation gate.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationRuntimeSnapshot {
+    /// All configured keywords.
+    pub keywords: Vec<ModerationKeyword>,
+    /// Session keys with `banned` status.
+    pub banned_session_keys: Vec<String>,
+    /// Reviewed false-positive hits with `unbanned` status.
+    pub suppressed_hits: Vec<ModerationSuppressedHit>,
+}
diff --git a/crates/llm-access-core/src/store/traits.rs b/crates/llm-access-core/src/store/traits.rs
index 96e5e3b9..8b06c188 100644
--- a/crates/llm-access-core/src/store/traits.rs
+++ b/crates/llm-access-core/src/store/traits.rs
@@ -33,6 +33,12 @@ use super::{
         AdminKiroBalanceView, AdminKiroStatusCacheUpdate, KiroStatusRefreshTarget,
         NewAdminKiroAccount,
     },
+    moderation::{
+        ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
+        ModerationCategory, ModerationKeyword, ModerationKeywordImportOutcome,
+        ModerationRuntimeSnapshot, NewModerationBannedSession, NewModerationCategory,
+        NewModerationKeyword,
+    },
     proxy::{
         AdminProxyBinding, AdminProxyConfig, AdminProxyConfigPatch, AdminProxyEndpointCheckUpdate,
         AdminProxyTrafficSnapshot, NewAdminProxyConfig,
@@ -279,6 +285,76 @@ pub trait AdminAnthropicUpstreamStore: Send + Sync {
     }
 }
 
+/// Keyword moderation queries used by the request hot path (startup snapshot,
+/// new ban records) and the admin review surface.
+#[async_trait]
+pub trait AdminModerationStore: Send + Sync {
+    /// Load the compact runtime snapshot consumed by the in-memory gate:
+    /// all keywords (with their categories), active banned session keys, and
+    /// reviewed false-positive hits.
+    async fn load_moderation_runtime_snapshot(&self) -> anyhow::Result<ModerationRuntimeSnapshot>;
+
+    /// List all configured risk categories.
+    async fn list_moderation_categories(&self) -> anyhow::Result<Vec<ModerationCategory>>;
+
+    /// Insert categories in bulk, skipping ones whose code already exists.
+    async fn add_moderation_categories(
+        &self,
+        categories: Vec<NewModerationCategory>,
+    ) -> anyhow::Result<usize>;
+
+    /// Delete one category by code. Returns the deleted category when found.
+    /// Implementations should refuse deletion while keywords still reference
+    /// it.
+    async fn delete_moderation_category(
+        &self,
+        code: &str,
+    ) -> anyhow::Result<Option<ModerationCategory>>;
+
+    /// List all configured moderation keywords with their categories.
+    async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>>;
+
+    /// Insert keywords in bulk, skipping ones that already exist.
+    async fn add_moderation_keywords(
+        &self,
+        keywords: Vec<NewModerationKeyword>,
+    ) -> anyhow::Result<ModerationKeywordImportOutcome>;
+
+    /// Delete one keyword by id. Returns the deleted keyword when found.
+    async fn delete_moderation_keyword(&self, id: i64)
+        -> anyhow::Result<Option<ModerationKeyword>>;
+
+    /// Persist one new banned session with its captured request payload.
+    /// Returns `false` when the session key was already recorded.
+    async fn record_moderation_banned_session(
+        &self,
+        record: NewModerationBannedSession,
+    ) -> anyhow::Result<bool>;
+
+    /// List one page of banned sessions, optionally filtered by status.
+    async fn list_moderation_banned_sessions(
+        &self,
+        page: AdminPageRequest,
+        status: Option<&str>,
+    ) -> anyhow::Result<ModerationBannedSessionsPage>;
+
+    /// Load one banned session including the captured request payload.
+    async fn get_moderation_banned_session(
+        &self,
+        id: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSessionDetail>>;
+
+    /// Set the review status (`banned`/`unbanned`) for one session record.
+    /// Returns the updated card when found.
+    async fn set_moderation_banned_session_status(
+        &self,
+        id: i64,
+        status: &str,
+        review_note: Option<&str>,
+        reviewed_at_ms: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSession>>;
+}
+
 /// Public read-only queries used by unauthenticated public endpoints.
 #[async_trait]
 pub trait PublicAccessStore: Send + Sync {
diff --git a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
new file mode 100644
index 00000000..acbb52b4
--- /dev/null
+++ b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
@@ -0,0 +1,63 @@
+-- Keyword moderation, durable control-plane state.
+--
+-- The request hot path never reads these tables directly: the llm-access
+-- `moderation` gate loads a compact snapshot into process memory on startup /
+-- periodic refresh / admin change, and writes here only when a NEW session is
+-- banned. See crates/llm-access/src/moderation.rs for the caching contract.
+--
+--   llm_moderation_keywords         -- one row per banned phrase (canonical,
+--                                      already tokenized; UNIQUE for dedup)
+--   llm_moderation_banned_sessions  -- one row per banned hit, with the
+--                                      captured request body + headers (TEXT,
+--                                      verbatim) for reviewer inspection
+
+CREATE TABLE IF NOT EXISTS llm_moderation_keywords (
+    id BIGSERIAL PRIMARY KEY,
+    keyword TEXT NOT NULL UNIQUE CHECK (length(keyword) > 0),
+    note TEXT,
+    source TEXT NOT NULL DEFAULT 'txt' CHECK (source IN ('txt', 'json')),
+    created_at_ms BIGINT NOT NULL CHECK (created_at_ms >= 0)
+);
+
+CREATE TABLE IF NOT EXISTS llm_moderation_banned_sessions (
+    id BIGSERIAL PRIMARY KEY,
+    hit_key TEXT NOT NULL UNIQUE CHECK (length(hit_key) > 0),
+    session_key TEXT NOT NULL CHECK (length(session_key) > 0),
+    provider TEXT NOT NULL,
+    key_id TEXT NOT NULL,
+    key_name TEXT NOT NULL DEFAULT '',
+    session_id TEXT NOT NULL DEFAULT '',
+    matched_keyword TEXT NOT NULL,
+    matched_context TEXT NOT NULL DEFAULT '',
+    match_start BIGINT NOT NULL CHECK (match_start >= 0),
+    match_end BIGINT NOT NULL CHECK (match_end >= match_start),
+    match_prefix_sha256 TEXT NOT NULL DEFAULT '',
+    keyword_set_hash TEXT NOT NULL DEFAULT '',
+    endpoint TEXT NOT NULL DEFAULT '',
+    model TEXT NOT NULL DEFAULT '',
+    client_ip TEXT NOT NULL DEFAULT '',
+    -- Captured verbatim as TEXT (not JSONB) so the exact request bytes are
+    -- preserved for review rather than reparsed/reordered through JSONB.
+    request_headers_json TEXT NOT NULL DEFAULT '{}',
+    request_body_json TEXT NOT NULL DEFAULT '',
+    status TEXT NOT NULL DEFAULT 'banned' CHECK (status IN ('banned', 'unbanned')),
+    review_note TEXT,
+    banned_at_ms BIGINT NOT NULL CHECK (banned_at_ms >= 0),
+    reviewed_at_ms BIGINT CHECK (reviewed_at_ms IS NULL OR reviewed_at_ms >= 0),
+    updated_at_ms BIGINT NOT NULL CHECK (updated_at_ms >= 0)
+);
+
+CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_status_banned_at
+    ON llm_moderation_banned_sessions(status, banned_at_ms DESC, id DESC);
+
+CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_banned_at
+    ON llm_moderation_banned_sessions(banned_at_ms DESC, id DESC);
+
+CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_key_id
+    ON llm_moderation_banned_sessions(key_id, banned_at_ms DESC);
+
+-- A session may hold several ban rows over time (one per distinct keyword hit,
+-- as content is reviewed and later content re-scanned). Uniqueness is per hit
+-- (hit_key UNIQUE); the runtime derives per-session banned state via
+-- SELECT DISTINCT session_key WHERE status = 'banned'. There is deliberately no
+-- unique constraint on session_key.
diff --git a/crates/llm-access-migrations/migrations/postgres/0037_moderation_categories.sql b/crates/llm-access-migrations/migrations/postgres/0037_moderation_categories.sql
new file mode 100644
index 00000000..c45c6a3b
--- /dev/null
+++ b/crates/llm-access-migrations/migrations/postgres/0037_moderation_categories.sql
@@ -0,0 +1,708 @@
+-- Keyword moderation risk categories.
+--
+-- Adds a category taxonomy and classifies keywords under it. A keyword may
+-- belong to several categories (category_codes is a JSONB array of codes), and
+-- a ban record captures the categories of the keyword that fired
+-- (matched_categories). Categories are managed separately from keywords so the
+-- taxonomy can grow without touching keyword rows.
+
+CREATE TABLE IF NOT EXISTS llm_moderation_categories (
+    code TEXT PRIMARY KEY CHECK (length(code) > 0),
+    label TEXT NOT NULL,
+    description TEXT NOT NULL DEFAULT '',
+    severity TEXT NOT NULL DEFAULT 'medium'
+        CHECK (severity IN ('critical', 'high', 'medium', 'low')),
+    created_at_ms BIGINT NOT NULL CHECK (created_at_ms >= 0)
+);
+
+ALTER TABLE llm_moderation_keywords
+    ADD COLUMN IF NOT EXISTS category_codes JSONB NOT NULL DEFAULT '[]'::jsonb;
+
+ALTER TABLE llm_moderation_banned_sessions
+    ADD COLUMN IF NOT EXISTS matched_categories JSONB NOT NULL DEFAULT '[]'::jsonb;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint
+        WHERE conname = 'ck_llm_moderation_keywords_category_codes_array'
+    ) THEN
+        ALTER TABLE llm_moderation_keywords
+            ADD CONSTRAINT ck_llm_moderation_keywords_category_codes_array
+            CHECK (jsonb_typeof(category_codes) = 'array');
+    END IF;
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint
+        WHERE conname = 'ck_llm_moderation_banned_sessions_matched_categories_array'
+    ) THEN
+        ALTER TABLE llm_moderation_banned_sessions
+            ADD CONSTRAINT ck_llm_moderation_banned_sessions_matched_categories_array
+            CHECK (jsonb_typeof(matched_categories) = 'array');
+    END IF;
+END $$;
+
+-- GIN index so "which keywords reference category X" (delete guard) and
+-- category-filtered keyword queries stay fast as the keyword set grows.
+CREATE INDEX IF NOT EXISTS idx_llm_moderation_keywords_category_codes
+    ON llm_moderation_keywords USING gin (category_codes jsonb_path_ops);
+
+-- Seed the 11-category taxonomy (aligned to the OpenAI usage policy domains).
+INSERT INTO llm_moderation_categories (code, label, description, severity, created_at_ms) VALUES
+    ('csam', '儿童性内容 / Child sexual (CSAM)', 'Sexual content involving minors. Zero tolerance.', 'critical', 1704067200000),
+    ('sexual', '成人性内容 / Adult sexual (NSFW)', 'Adult pornographic or sexually explicit content.', 'high', 1704067200000),
+    ('weapons', '武器与危险物 / Weapons, explosives & CBRN', 'Weapons, explosives, firearms, and chemical/biological/radiological/nuclear materials.', 'critical', 1704067200000),
+    ('extremism', '暴力极端 / Violent extremism', 'Terrorism, mass-casualty attacks, violent extremism, and ethnic cleansing.', 'critical', 1704067200000),
+    ('drugs', '毒品制贩 / Illicit drugs', 'Manufacture, synthesis, or trafficking of illicit drugs.', 'high', 1704067200000),
+    ('criminal', '暴力犯罪与贩卖 / Violent crime & trafficking', 'Violence-for-hire, human/organ trafficking, and facilitation of real-world crimes.', 'critical', 1704067200000),
+    ('fraud', '欺诈与黑产 / Fraud & scams', 'Scams, money laundering, counterfeiting, phishing-as-fraud, and black-market operations.', 'high', 1704067200000),
+    ('cyber', '网络攻击与恶意软件 / Cybercrime & malware', 'Malware, ransomware, hacking, unauthorized access, credential theft, and exploits (OpenAI cyber policy).', 'high', 1704067200000),
+    ('piracy', '盗版破解与外挂 / Piracy, cracking & cheats', 'Software cracking, DRM/anti-cheat circumvention, and game cheats.', 'medium', 1704067200000),
+    ('self_harm', '自我伤害 / Self-harm & suicide', 'Suicide or self-harm methods and encouragement.', 'critical', 1704067200000),
+    ('jailbreak', '越狱与提示注入 / AI jailbreak', 'AI safety-bypass and prompt-injection attempts.', 'medium', 1704067200000)
+ON CONFLICT (code) DO NOTHING;
+
+-- Seed the classified keyword blocklist (generated; see the moderation seed).
+INSERT INTO llm_moderation_keywords (keyword, source, category_codes, created_at_ms) VALUES
+    ('child porn', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('child pornography', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('underage porn', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('underage sex video', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('preteen sex', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('toddler porn', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('infant porn', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('minor nude photo', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('pedophile guide', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('how to groom a child', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('loli sex', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('shota sex', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('lolicon', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('shotacon', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('underage roleplay sexual', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('儿 童 色 情', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('幼 女 性 交', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('幼 童 裸 照', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('未 成 年 性 视 频', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('未 成 年 性 描 写', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('幼 女 色 情', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('幼 女 性 描 写', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('萝 莉 色 情', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('萝 莉 性 描 写', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('正 太 色 情', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('how to make a bomb', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('build a pipe bomb', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('pressure cooker bomb', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('homemade explosive recipe', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('ied construction', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('tatp synthesis', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('detonator wiring', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('nerve agent synthesis', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('sarin gas production', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('mustard gas recipe', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('weaponize anthrax', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('ricin extraction', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('chlorine gas weapon', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('dirty bomb design', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('制 造 炸 弹', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('炸 药 配 方', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('自 制 爆 炸 物', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('沙 林 毒 气 制 作', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('生 化 武 器 制 造', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('蓖 麻 毒 素 提 取', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('ghost gun build', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('3d printed firearm files', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('untraceable gun', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('自 制 枪 支', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('枪 支 改 造 教 程', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('mass shooting plan', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('school shooting plan', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('how to plan an attack on', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('maximize casualties', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('terrorist recruitment', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('ethnic cleansing', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('校 园 枪 击 计 划', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('恐 怖 组 织 招 募', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('种 族 清 洗', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('methamphetamine synthesis', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('how to make meth', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('fentanyl synthesis', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('mdma synthesis', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('drug lab setup', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('dark web drug vendor', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('制 毒 方 法', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('冰 毒', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('芬 太 尼 合 成', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('摇 头 丸 制 作', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('hire a hitman', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('human trafficking', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('organ trafficking', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('雇 凶 杀 人', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('买 凶 杀 人', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('人 口 贩 卖', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('器 官 买 卖', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('money laundering method', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('how to launder money', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('romance scam script', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('fake investment platform', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('counterfeit currency printing', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('ponzi scheme setup', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('carding tutorial', 'txt', '["fraud","cyber"]'::jsonb, 1704067200000),
+    ('信 用 卡 盗 刷 教 程', 'txt', '["fraud","cyber"]'::jsonb, 1704067200000),
+    ('洗 钱 渠 道', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('电 信 诈 骗 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('杀 猪 盘 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('假 币 制 作', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('ransomware source code', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('build a ransomware', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('write a keylogger', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('remote access trojan code', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('botnet command and control', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('credential stuffing tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('credential stuffing attack', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('phishing kit download', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('phishing page source', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('0day exploit for sale', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('atm skimmer build', 'txt', '["cyber","fraud"]'::jsonb, 1704067200000),
+    ('account cracker tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('account credential theft', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('brute force password tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('brute force password crack', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('password cracking tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('rainbow table crack', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('hash cracking tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('wifi hacking tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('hack someone s account', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('sql injection to hack', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('unauthorized access tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('privilege escalation exploit', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('root exploit code', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('reverse shell exploit', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('webshell backdoor', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('webshell upload', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('撞 库 脚 本', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('撞 库 攻 击', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('盗 号 木 马', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('盗 号 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('盗 号 软 件', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('账 号 盗 取 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('盗 取 他 人 账 号', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('入 侵 他 人 网 站', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('勒 索 病 毒 源 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('勒 索 病 毒 制 作', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('钓 鱼 网 站 源 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('钓 鱼 源 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('钓 鱼 页 面 制 作', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('木 马 病 毒 制 作', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('键 盘 记 录 木 马', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('远 程 控 制 木 马', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('蠕 虫 病 毒 代 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('后 门 程 序 安 装', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('暴 力 破 解 密 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('密 码 爆 破 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('免 杀 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('免 杀 马', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('root 提 权 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('提 权 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('提 权 漏 洞 利 用', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('脱 壳 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('砸 壳 脱 壳', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('协 议 逆 向 破 解', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('内 存 抓 取 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('software cracking tool', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('crack license key', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('bypass license verification', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('bypass license check', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('keygen for', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('keygen crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('serial number crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('activation crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('nulled software', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('pirated software download', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('warez download', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('drm bypass', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('drm removal tool', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('注 册 机', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('注 册 机 下 载', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('软 件 破 解 教 程', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('破 解 补 丁', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('序 列 号 破 解', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('外 挂 软 件', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 透 视 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 自 瞄 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('自 瞄 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('外 挂 注 入', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('代 码 注 入 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('外 挂 制 作 教 程', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 内 存 修 改', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('封 包 修 改 工 具', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('aimbot', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('wallhack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('maphack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('cheat engine hack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('game trainer cheat', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('speed hack game', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('aim assist hack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('no recoil hack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('god mode cheat', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('unlimited ammo cheat', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('painless suicide method', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('most lethal way to kill myself', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('lethal dose to die', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('无 痛 自 杀 方 法', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('烧 炭 自 杀 教 程', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('dan jailbreak', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('jailbreak prompt nsfw', 'txt', '["jailbreak","sexual"]'::jsonb, 1704067200000),
+    ('uncensored ai mode', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('ignore safety guidelines nsfw', 'txt', '["jailbreak","sexual"]'::jsonb, 1704067200000),
+    ('write explicit sex scene', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('write graphic sex scene', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('write porn story', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('generate nude image', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('generate explicit content', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('generate hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('generate nsfw content', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('adult content generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('explicit content generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nsfw image generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('explicit image generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude image generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pornographic image generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('child sex', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('blowjob', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('handjob', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cumshot', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('creampie', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('deepthroat', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('gangbang', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('bukkake', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('oral sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('anal sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('doggystyle', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cunnilingus', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('fellatio', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('masturbation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dildo', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('butt plug', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('clitoris', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ejaculation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('threesome', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('bdsm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dominatrix', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('footjob', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rimjob', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('golden shower', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ahegao', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('futanari', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nakadashi', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pornography', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('porn video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex tape', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude selfie', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude photo', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('xxx video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('adult film', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cam girl', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('prostitution', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex doll', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('fleshlight', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('vaginal sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('penile penetration', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual intercourse', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('breast fondling', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple sucking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy eating', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy licking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cock sucking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dick sucking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('double penetration', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('fisting sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('squirting orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('facial cumshot', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cum inside', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cum on face', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cum swallow', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erect penis', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('wet vagina', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy fingering', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ass penetration', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cock and ball torture', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple torture', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple clamp', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rope bondage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('wax play', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex slave', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex dungeon', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('shibari bondage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pegging sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('strapon sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cuckold sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('voyeur video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('public sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('glory hole', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex party', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('swinger sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('milf porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('teen porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('amateur porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('homemade porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('incest roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('step sister sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('step brother sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('step mom sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('step dad sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('taboo sex roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ruined orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('forced orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic massage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('happy ending massage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nuru massage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('striptease nude', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pornstar', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cybersex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('phone sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexting nude', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dick pic', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy pic', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('lewd roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('smut writing', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic fiction', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual fanfic', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('furry porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('yiff', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rule34', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('anime porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('manga porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('hentai manga', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('hentai video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('uncensored hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('tentacle hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('monster sex hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('bestiality', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('zoophilia', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rape fantasy', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rape roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('non consent sex roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('forced sex roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual violence roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('drugged sex', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('sex blackmail', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('erotic hypnosis', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('incest sex story', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('family sex roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic audio', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nsfw audio', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('write erotic content', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('write sexual content', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('做 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('肛 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('龟 头', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('爱 液', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('潮 吹', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('潮 喷', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('自 慰', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('手 淫', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 爆', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('内 射', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('颜 射', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('足 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('群 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('轮 奸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('强 奸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阳 具', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 唇', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 蒂', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 道', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 茎', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 头', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 房', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('生 殖 器', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 器 官', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('射 精', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 道 哑 铃', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('月 经 自 由', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 道 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 茎 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('私 处 展 示', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 侵', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乱 伦', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('腋 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('脚 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 奴', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('约 炮', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('炮 友', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('嫖 娼', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('卖 淫', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 交 易', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('换 妻', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 虐 待', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('迷 奸 描 写', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('下 药 侵 犯', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('迷 药 性 爱', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('性 胁 迫', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('强 制 性 交', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('强 迫 性 爱 描 写', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('淫 荡 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('淫 秽 内 容', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('淫 秽 图 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('淫 秽 视 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 视 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 图 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 故 事', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 视 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 故 事', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 聊 天', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 自 拍', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('成 人 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('淫 乱 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('裸 照', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('私 房 照', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('私 处 照 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('不 雅 视 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('全 裸 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('裸 体 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('裸 体 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('偷 拍 裸 体', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('偷 窥 色 情', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('露 出 癖', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('摸 奶', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('揉 奶', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('舔 奶', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('摸 胸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('揉 胸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('舔 胸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('肛 塞', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('飞 机 杯', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('按 摩 棒', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('振 动 棒', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('跳 蛋', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('充 气 娃 娃', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('援 助 交 际', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('卖 淫 嫖 娼', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('开 房 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 派 对', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 交 吞 精', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('吞 精 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('深 喉 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('多 人 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('集 体 性 爱 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('捆 绑 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('鞭 打 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('调 教 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 描 写 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('露 骨 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 剧 情', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('母 子 乱 伦', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('父 女 乱 伦', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('兄 妹 乱 伦', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('亲 子 性 爱 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('撸 管 教 程', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('成 人 网 站 推 荐', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 网 站', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('av 女 优', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('无 码 av', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('三 级 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 文 学', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 文 学', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('写 色 情 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('生 成 色 情 图 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('写 性 爱 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('生 成 裸 体 图 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('写 露 骨 内 容', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ai 色 情 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('刷 单', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('刷 好 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('刷 差 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('虚 假 好 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('虚 假 评 论', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 好 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('水 军', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('网 络 水 军', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('养 号', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 注 册 账 号', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('接 码 平 台', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('群 发 广 告', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('裸 聊 敲 诈', 'txt', '["fraud","sexual"]'::jsonb, 1704067200000),
+    ('裸 聊 勒 索', 'txt', '["fraud","sexual"]'::jsonb, 1704067200000),
+    ('引 流 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('拉 人 头 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('赌 博 网 站 推 广', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('博 彩 推 广', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('菠 菜 推 广', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('色 流 引 流', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('黑 卡 盗 刷', 'txt', '["fraud","cyber"]'::jsonb, 1704067200000),
+    ('四 件 套 买 卖', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('跑 分 洗 钱', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('虚 拟 币 跑 分', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('冒 充 客 服 诈 骗', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('冒 充 公 检 法', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('贷 款 诈 骗 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('刷 单 返 利 诈 骗', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('兼 职 刷 单 诈 骗', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('注 销 校 园 贷', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('钓 鱼 短 信 模 板', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('诈 骗 短 信 模 板', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('诈 骗 话 术 生 成', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('营 销 软 文 代 写', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('软 文 代 写', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('书 评 生 成', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 书 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 生 成 书 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('代 写 书 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('刷 书 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('书 评 水 军', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('代 写 好 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 营 销 文 案', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('营 销 号 文 案 批 量', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 软 文 生 成', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('越 狱 提 示 词', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('破 限 提 示 词', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('绕 过 道 德 限 制', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('绕 过 内 容 审 核', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('绕 过 安 全 限 制', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('解 除 限 制 模 式', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('忽 略 系 统 提 示', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('忽 略 之 前 的 指 令', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('忽 略 以 上 所 有 指 令', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('ignore previous instructions', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('ignore all previous instructions', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('disregard your guidelines', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('disregard previous instructions', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('developer mode enabled', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('do anything now', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('stay in character as', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('roleplay as an unrestricted ai', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('drm crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('drm removal', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('bypass drm protection', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('crack download', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('license crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('license keygen', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('软 件 crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('软 件 破 解 版', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('破 解 软 件', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('破 解 软 件 授 权', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('激 活 码 破 解', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('越 狱 破 解', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('逆 向 授 权 绕 过', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('绕 过 激 活 验 证', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('绕 过 反 作 弊', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('activation lock bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('icloud bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('mdm bypass exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('frida jailbreak bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('ssl pinning bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('jailbreak bypass tool', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('anti cheat bypass', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('eac bypass', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('battleye bypass', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('easy anti cheat bypass', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('anti debug bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('bootloader unlock exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('magisk root exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('firmware dump exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('rom dump tool', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('memory dumping tool', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('process injection exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('code injection exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('dll injection cheat', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('aimbot download', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('wallhack cheat', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('esp hack game', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('game cheat engine', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('game memory editor', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 外 挂 制 作', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 破 解 版 下 载', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('sm 道 具', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('airtight gangbang', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('bondage sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('breast licking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('breast sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cam show', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('clitoral stimulation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cock riding', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cock worship', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cum tribute', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dick riding', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('doujinshi nsfw', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('edging orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic roleplay ai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('exhibitionism sexual', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('explicit video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('foot fetish explicit', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('g spot stimulation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('hard penis', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('jailbreak nsfw', 'txt', '["jailbreak","sexual"]'::jsonb, 1704067200000),
+    ('lactation fetish', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('lewd ai roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('multiple orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple licking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple play', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude exchange', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude modeling explicit', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('onlyfans leak', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('orgy', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('outdoor sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('panty fetish sexual', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('porn actress', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pornographic story', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('prostate stimulation sexual', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy juice', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy worship', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('semen swallow', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex roleplay ai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual climax', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('spitroast sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('strap on sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('tit job', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('vaginal lubrication', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('vaginal penetration', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('vibrator', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('上 床 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 头 夹', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 头 虐 待', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('冰 毒 制 作', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('前 列 腺 按 摩 性', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('勃 起 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 交 口 爆', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 腔 性 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('后 入 体 位', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 刺 激 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 服 务', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 剧 情', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 无 码', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 机 器 人', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 音 频 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 玩 具 使 用', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 高 潮', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 电 影 推 荐', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('成 人 影 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('手 淫 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('抽 插 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('无 套 内 射', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('无 套 性 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('有 码 av', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('精 液 吞 咽', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('肉 欲 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('肛 门 性 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('胸 部 展 示 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('自 慰 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 无 码', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 音 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('萝 莉 色 情 视 频', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('阴 毛', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 道 扩 张', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('骑 乘 位 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000)
+ON CONFLICT (keyword) DO NOTHING;
diff --git a/crates/llm-access-migrations/src/lib.rs b/crates/llm-access-migrations/src/lib.rs
index 48747fd1..503ae819 100644
--- a/crates/llm-access-migrations/src/lib.rs
+++ b/crates/llm-access-migrations/src/lib.rs
@@ -183,6 +183,16 @@ const POSTGRES_MIGRATIONS: &[SqlMigration] = &[
         name: "kiro_model_group_preferences",
         sql: include_str!("../migrations/postgres/0035_kiro_model_group_preferences.sql"),
     },
+    SqlMigration {
+        version: 36,
+        name: "keyword_moderation",
+        sql: include_str!("../migrations/postgres/0036_keyword_moderation.sql"),
+    },
+    SqlMigration {
+        version: 37,
+        name: "moderation_categories",
+        sql: include_str!("../migrations/postgres/0037_moderation_categories.sql"),
+    },
 ];
 
 /// Return target DuckDB migrations in execution order.
diff --git a/crates/llm-access-store/src/postgres.rs b/crates/llm-access-store/src/postgres.rs
index 5abaf2bd..08320f6f 100644
--- a/crates/llm-access-store/src/postgres.rs
+++ b/crates/llm-access-store/src/postgres.rs
@@ -38,6 +38,7 @@ mod groups;
 mod json;
 mod keys;
 mod kiro_account;
+mod moderation;
 mod proxy;
 mod proxy_support;
 mod public;
@@ -784,12 +785,13 @@ mod tests {
             AdminAnthropicUpstreamModelsStatusUpdate, AdminAnthropicUpstreamStore,
             AdminAnthropicUpstreamTestStatusUpdate, AdminCodexAccountPageQuery,
             AdminCodexAccountSortMode, AdminCodexAccountStore, AdminConfigStore, AdminKeyStore,
-            AdminKiroAccountStore, AdminPageRequest, AdminProxyConfigPatch, AdminProxyStore,
-            AdminProxyTrafficSnapshot, AdminReviewQueueStore, AnthropicUpstreamChannelUsageDelta,
-            ControlStore, KeyUsageRollupDelta, NewAdminAnthropicUpstreamChannel,
-            NewAdminProxyConfig, NewPublicAccountContributionRequest, ProviderRouteStore,
-            ProxyTrafficTotals, PublicSubmissionStore, PublicUsageStore, UsageEventSink,
-            UsageRollupBatch, UsageRollupBatchSink,
+            AdminKiroAccountStore, AdminModerationStore, AdminPageRequest, AdminProxyConfigPatch,
+            AdminProxyStore, AdminProxyTrafficSnapshot, AdminReviewQueueStore,
+            AnthropicUpstreamChannelUsageDelta, ControlStore, KeyUsageRollupDelta,
+            NewAdminAnthropicUpstreamChannel, NewAdminProxyConfig, NewModerationBannedSession,
+            NewModerationCategory, NewModerationKeyword, NewPublicAccountContributionRequest,
+            ProviderRouteStore, ProxyTrafficTotals, PublicSubmissionStore, PublicUsageStore,
+            UsageEventSink, UsageRollupBatch, UsageRollupBatchSink,
         },
     };
     use serde::Serialize;
@@ -845,6 +847,9 @@ mod tests {
         client
             .batch_execute(
                 "TRUNCATE TABLE
+                    llm_moderation_banned_sessions,
+                    llm_moderation_keywords,
+                    llm_moderation_categories,
                     llm_account_import_job_items,
                     llm_account_import_jobs,
                     llm_codex_status_cache,
@@ -1984,6 +1989,297 @@ mod tests {
         client.close().await;
     }
 
+    #[tokio::test]
+    async fn postgres_repository_manages_moderation_keywords_and_bans() {
+        let Ok(database_url) = std::env::var("TEST_POSTGRES_URL") else {
+            eprintln!("skipping postgres integration test: TEST_POSTGRES_URL is not set");
+            return;
+        };
+        let _guard = test_db_guard().await;
+        reset_test_db(&database_url)
+            .await
+            .expect("reset postgres test database");
+        let repo = super::PostgresControlRepository::connect(&database_url, None)
+            .await
+            .expect("connect postgres repository");
+
+        let now = 1_700_000_000_000;
+
+        // Categories: bulk insert + code conflict dedup.
+        let category_inserted = repo
+            .add_moderation_categories(vec![
+                NewModerationCategory {
+                    code: "weapons".to_string(),
+                    label: "Weapons".to_string(),
+                    description: "Weapons and explosives.".to_string(),
+                    severity: "critical".to_string(),
+                    created_at_ms: now,
+                },
+                NewModerationCategory {
+                    code: "fraud".to_string(),
+                    label: "Fraud".to_string(),
+                    description: String::new(),
+                    severity: "high".to_string(),
+                    created_at_ms: now,
+                },
+                NewModerationCategory {
+                    code: "weapons".to_string(),
+                    label: "dup".to_string(),
+                    description: String::new(),
+                    severity: "low".to_string(),
+                    created_at_ms: now,
+                },
+            ])
+            .await
+            .expect("add moderation categories");
+        assert_eq!(category_inserted, 2);
+        assert_eq!(
+            repo.list_moderation_categories()
+                .await
+                .expect("list categories")
+                .len(),
+            2
+        );
+
+        // Bulk keyword insert with categories: exercises the UNNEST array
+        // binding, NULLIF(note, ''), category_codes JSONB, and ON CONFLICT dedup.
+        let outcome = repo
+            .add_moderation_keywords(vec![
+                NewModerationKeyword {
+                    keyword: "build a bomb".to_string(),
+                    categories: vec!["weapons".to_string()],
+                    note: Some("danger".to_string()),
+                    source: "txt".to_string(),
+                    created_at_ms: now,
+                },
+                NewModerationKeyword {
+                    keyword: "free phrase".to_string(),
+                    categories: Vec::new(),
+                    note: None,
+                    source: "json".to_string(),
+                    created_at_ms: now,
+                },
+                NewModerationKeyword {
+                    keyword: "build a bomb".to_string(),
+                    categories: vec!["weapons".to_string()],
+                    note: None,
+                    source: "txt".to_string(),
+                    created_at_ms: now,
+                },
+            ])
+            .await
+            .expect("add moderation keywords");
+        assert_eq!(outcome.inserted, 2);
+        assert_eq!(outcome.duplicates, 1);
+
+        // Re-importing an existing keyword is skipped, not errored.
+        let repeat = repo
+            .add_moderation_keywords(vec![NewModerationKeyword {
+                keyword: "build a bomb".to_string(),
+                categories: vec!["weapons".to_string()],
+                note: None,
+                source: "txt".to_string(),
+                created_at_ms: now,
+            }])
+            .await
+            .expect("re-add moderation keyword");
+        assert_eq!(repeat.inserted, 0);
+        assert_eq!(repeat.duplicates, 1);
+
+        let keywords = repo
+            .list_moderation_keywords()
+            .await
+            .expect("list moderation keywords");
+        assert_eq!(keywords.len(), 2);
+        let bomb = keywords
+            .iter()
+            .find(|keyword| keyword.keyword == "build a bomb")
+            .expect("bomb keyword present");
+        assert_eq!(bomb.note.as_deref(), Some("danger"));
+        assert_eq!(bomb.categories, vec!["weapons".to_string()]);
+        let free = keywords
+            .iter()
+            .find(|keyword| keyword.keyword == "free phrase")
+            .expect("free keyword present");
+        assert_eq!(free.note, None);
+        assert!(free.categories.is_empty());
+
+        // A referenced category cannot be deleted; an unreferenced one can.
+        assert!(repo.delete_moderation_category("weapons").await.is_err());
+        assert_eq!(
+            repo.delete_moderation_category("fraud")
+                .await
+                .expect("delete unreferenced category")
+                .expect("deleted category")
+                .code,
+            "fraud"
+        );
+
+        // Delete: RETURNING yields the removed row; a second delete is a no-op.
+        let deleted = repo
+            .delete_moderation_keyword(bomb.id)
+            .await
+            .expect("delete moderation keyword");
+        assert_eq!(deleted.expect("deleted row").keyword, "build a bomb");
+        assert!(repo
+            .delete_moderation_keyword(bomb.id)
+            .await
+            .expect("delete missing keyword")
+            .is_none());
+        assert_eq!(
+            repo.list_moderation_keywords()
+                .await
+                .expect("list after delete")
+                .len(),
+            1
+        );
+
+        // Banned hits: JSONB body + headers persisted, hit_key unique.
+        let record = NewModerationBannedSession {
+            hit_key: "hit-1".to_string(),
+            session_key: "kiro:key-1:sess-1".to_string(),
+            provider: "kiro".to_string(),
+            key_id: "key-1".to_string(),
+            key_name: "external".to_string(),
+            session_id: "sess-1".to_string(),
+            matched_keyword: "build a bomb".to_string(),
+            matched_categories: vec!["weapons".to_string()],
+            matched_context: "…how to build a bomb now…".to_string(),
+            match_start: 7,
+            match_end: 19,
+            match_prefix_sha256: "prefix-1".to_string(),
+            keyword_set_hash: "keywords-v1".to_string(),
+            endpoint: "/v1/messages".to_string(),
+            model: "claude-sonnet-4".to_string(),
+            client_ip: "127.0.0.1".to_string(),
+            request_headers_json:
+                r#"{"authorization":"<redacted>","content-type":"application/json"}"#.to_string(),
+            request_body_json:
+                r#"{"model":"claude-sonnet-4","messages":[{"role":"user","content":"how to build a bomb"}]}"#
+                    .to_string(),
+            banned_at_ms: now,
+        };
+        assert!(repo
+            .record_moderation_banned_session(record.clone())
+            .await
+            .expect("record banned session"));
+        // Duplicate hit_key: ON CONFLICT DO NOTHING -> not inserted again.
+        assert!(!repo
+            .record_moderation_banned_session(record.clone())
+            .await
+            .expect("record duplicate banned session"));
+
+        let second = NewModerationBannedSession {
+            hit_key: "hit-2".to_string(),
+            session_key: "codex:key-1:sess-2".to_string(),
+            provider: "codex".to_string(),
+            session_id: "sess-2".to_string(),
+            ..record.clone()
+        };
+        assert!(repo
+            .record_moderation_banned_session(second)
+            .await
+            .expect("record second banned session"));
+
+        let banned = repo
+            .list_moderation_banned_sessions(
+                AdminPageRequest {
+                    limit: 10,
+                    offset: 0,
+                },
+                Some("banned"),
+            )
+            .await
+            .expect("list banned sessions");
+        assert_eq!(banned.total, 2);
+        assert_eq!(banned.sessions.len(), 2);
+
+        let target = banned
+            .sessions
+            .iter()
+            .find(|session| session.session_key == "kiro:key-1:sess-1")
+            .expect("kiro session present");
+        let detail = repo
+            .get_moderation_banned_session(target.id)
+            .await
+            .expect("load banned session detail")
+            .expect("banned session detail present");
+        assert!(detail.request_body_json.contains("how to build a bomb"));
+        assert!(detail.request_headers_json.contains("<redacted>"));
+        assert_eq!(detail.session.matched_categories, vec!["weapons".to_string()]);
+
+        // Review flow: unban records the note and flips the status filters.
+        let updated = repo
+            .set_moderation_banned_session_status(
+                target.id,
+                "unbanned",
+                Some("false positive"),
+                now + 1,
+            )
+            .await
+            .expect("review banned session")
+            .expect("reviewed session present");
+        assert_eq!(updated.status, "unbanned");
+        assert_eq!(updated.review_note.as_deref(), Some("false positive"));
+        assert_eq!(updated.reviewed_at_ms, Some(now + 1));
+
+        let still_banned = repo
+            .list_moderation_banned_sessions(
+                AdminPageRequest {
+                    limit: 10,
+                    offset: 0,
+                },
+                Some("banned"),
+            )
+            .await
+            .expect("list still-banned sessions");
+        assert_eq!(still_banned.total, 1);
+        let unbanned = repo
+            .list_moderation_banned_sessions(
+                AdminPageRequest {
+                    limit: 10,
+                    offset: 0,
+                },
+                Some("unbanned"),
+            )
+            .await
+            .expect("list unbanned sessions");
+        assert_eq!(unbanned.total, 1);
+
+        let followup_same_session = NewModerationBannedSession {
+            hit_key: "hit-3".to_string(),
+            matched_keyword: "carding tutorial".to_string(),
+            matched_categories: vec!["cyber".to_string()],
+            matched_context: "…carding tutorial…".to_string(),
+            match_start: 40,
+            match_end: 56,
+            match_prefix_sha256: "prefix-2".to_string(),
+            keyword_set_hash: "keywords-v1".to_string(),
+            banned_at_ms: now + 2,
+            ..record.clone()
+        };
+        assert!(repo
+            .record_moderation_banned_session(followup_same_session)
+            .await
+            .expect("record follow-up hit for same session"));
+
+        // Runtime snapshot mirrors the in-memory gate contract exactly.
+        let snapshot = repo
+            .load_moderation_runtime_snapshot()
+            .await
+            .expect("load moderation runtime snapshot");
+        assert_eq!(snapshot.keywords.len(), 1);
+        let mut banned_session_keys = snapshot.banned_session_keys;
+        banned_session_keys.sort();
+        assert_eq!(banned_session_keys, vec![
+            "codex:key-1:sess-2".to_string(),
+            "kiro:key-1:sess-1".to_string(),
+        ]);
+        assert_eq!(snapshot.suppressed_hits.len(), 1);
+        assert_eq!(snapshot.suppressed_hits[0].hit_key, "hit-1");
+        assert_eq!(snapshot.suppressed_hits[0].session_key, "kiro:key-1:sess-1");
+    }
+
     #[tokio::test]
     async fn postgres_repository_updates_key_usage_rollups() {
         let Ok(database_url) = std::env::var("TEST_POSTGRES_URL") else {
diff --git a/crates/llm-access-store/src/postgres/moderation.rs b/crates/llm-access-store/src/postgres/moderation.rs
new file mode 100644
index 00000000..1773f0bb
--- /dev/null
+++ b/crates/llm-access-store/src/postgres/moderation.rs
@@ -0,0 +1,495 @@
+//! Keyword moderation store: configured keywords plus banned sessions with
+//! their captured request payloads.
+
+use anyhow::Context;
+use async_trait::async_trait;
+use llm_access_core::store::{
+    AdminModerationStore, AdminPageRequest, ModerationBannedSession, ModerationBannedSessionDetail,
+    ModerationBannedSessionsPage, ModerationCategory, ModerationKeyword,
+    ModerationKeywordImportOutcome, ModerationRuntimeSnapshot, ModerationSuppressedHit,
+    NewModerationBannedSession, NewModerationCategory, NewModerationKeyword,
+    MODERATION_SESSION_STATUS_BANNED, MODERATION_SESSION_STATUS_UNBANNED,
+};
+
+use super::{now_ms, PgRow, PostgresControlRepository};
+
+const MODERATION_CATEGORY_COLUMNS: &str = "code, label, description, severity, created_at_ms";
+
+const MODERATION_KEYWORD_COLUMNS: &str =
+    "id, keyword, note, source, created_at_ms, category_codes::text";
+
+const MODERATION_BANNED_SESSION_COLUMNS: &str =
+    "id, hit_key, session_key, provider, key_id, key_name, session_id, matched_keyword, \
+     matched_context, match_start, match_end, match_prefix_sha256, keyword_set_hash, endpoint, \
+     model, client_ip, status, review_note, banned_at_ms, reviewed_at_ms, updated_at_ms, \
+     matched_categories::text";
+
+/// Decode a JSONB text-array column (e.g. `["csam","cyber"]`) into codes. A
+/// malformed value degrades to an empty list rather than failing the row.
+fn category_codes_from_json_text(raw: String) -> Vec<String> {
+    serde_json::from_str::<Vec<String>>(&raw).unwrap_or_default()
+}
+
+fn category_codes_to_json(codes: &[String]) -> String {
+    serde_json::to_string(codes).unwrap_or_else(|_| "[]".to_string())
+}
+
+fn moderation_category_from_row(row: &PgRow) -> ModerationCategory {
+    ModerationCategory {
+        code: row.get(0),
+        label: row.get(1),
+        description: row.get(2),
+        severity: row.get(3),
+        created_at_ms: row.get(4),
+    }
+}
+
+fn moderation_keyword_from_row(row: &PgRow) -> ModerationKeyword {
+    ModerationKeyword {
+        id: row.get(0),
+        keyword: row.get(1),
+        note: row.get(2),
+        source: row.get(3),
+        created_at_ms: row.get(4),
+        categories: category_codes_from_json_text(row.get(5)),
+    }
+}
+
+fn moderation_banned_session_from_row(row: &PgRow) -> ModerationBannedSession {
+    ModerationBannedSession {
+        id: row.get(0),
+        hit_key: row.get(1),
+        session_key: row.get(2),
+        provider: row.get(3),
+        key_id: row.get(4),
+        key_name: row.get(5),
+        session_id: row.get(6),
+        matched_keyword: row.get(7),
+        matched_context: row.get(8),
+        match_start: row.get(9),
+        match_end: row.get(10),
+        match_prefix_sha256: row.get(11),
+        keyword_set_hash: row.get(12),
+        endpoint: row.get(13),
+        model: row.get(14),
+        client_ip: row.get(15),
+        status: row.get(16),
+        review_note: row.get(17),
+        banned_at_ms: row.get(18),
+        reviewed_at_ms: row.get(19),
+        updated_at_ms: row.get(20),
+        matched_categories: category_codes_from_json_text(row.get(21)),
+    }
+}
+
+fn normalized_session_status_filter(status: Option<&str>) -> anyhow::Result<Option<&str>> {
+    match status.map(str::trim).filter(|value| !value.is_empty()) {
+        None => Ok(None),
+        Some(MODERATION_SESSION_STATUS_BANNED) => Ok(Some(MODERATION_SESSION_STATUS_BANNED)),
+        Some(MODERATION_SESSION_STATUS_UNBANNED) => Ok(Some(MODERATION_SESSION_STATUS_UNBANNED)),
+        Some(other) => anyhow::bail!("unsupported moderation session status filter `{other}`"),
+    }
+}
+
+#[async_trait]
+impl AdminModerationStore for PostgresControlRepository {
+    async fn load_moderation_runtime_snapshot(&self) -> anyhow::Result<ModerationRuntimeSnapshot> {
+        self.ensure_connection_alive()?;
+        let keywords = self.list_moderation_keywords().await?;
+        let banned_rows = self
+            .client
+            .query(
+                "SELECT DISTINCT session_key
+                 FROM llm_moderation_banned_sessions
+                 WHERE status = 'banned'",
+                &[],
+            )
+            .await
+            .context("load postgres moderation banned session keys")?;
+        let banned_session_keys = banned_rows.iter().map(|row| row.get(0)).collect();
+        let suppressed_rows = self
+            .client
+            .query(
+                "SELECT session_key, hit_key, match_start, match_end, match_prefix_sha256,
+                        keyword_set_hash
+                 FROM llm_moderation_banned_sessions
+                 WHERE status = 'unbanned'",
+                &[],
+            )
+            .await
+            .context("load postgres moderation suppressed hit keys")?;
+        let suppressed_hits = suppressed_rows
+            .iter()
+            .map(|row| ModerationSuppressedHit {
+                session_key: row.get(0),
+                hit_key: row.get(1),
+                match_start: row.get(2),
+                match_end: row.get(3),
+                match_prefix_sha256: row.get(4),
+                keyword_set_hash: row.get(5),
+            })
+            .collect();
+        Ok(ModerationRuntimeSnapshot {
+            keywords,
+            banned_session_keys,
+            suppressed_hits,
+        })
+    }
+
+    async fn list_moderation_categories(&self) -> anyhow::Result<Vec<ModerationCategory>> {
+        self.ensure_connection_alive()?;
+        let sql = format!(
+            "SELECT {MODERATION_CATEGORY_COLUMNS} FROM llm_moderation_categories ORDER BY code"
+        );
+        let rows = self
+            .client
+            .query(&sql, &[])
+            .await
+            .context("list postgres moderation categories")?;
+        Ok(rows.iter().map(moderation_category_from_row).collect())
+    }
+
+    async fn add_moderation_categories(
+        &self,
+        categories: Vec<NewModerationCategory>,
+    ) -> anyhow::Result<usize> {
+        self.ensure_connection_alive()?;
+        if categories.is_empty() {
+            return Ok(0);
+        }
+        let total = categories.len();
+        let mut code_values = Vec::with_capacity(total);
+        let mut label_values = Vec::with_capacity(total);
+        let mut description_values = Vec::with_capacity(total);
+        let mut severity_values = Vec::with_capacity(total);
+        let mut created_at_values = Vec::with_capacity(total);
+        for category in categories {
+            code_values.push(category.code);
+            label_values.push(category.label);
+            description_values.push(category.description);
+            severity_values.push(category.severity);
+            created_at_values.push(category.created_at_ms);
+        }
+        let inserted = self
+            .client
+            .execute(
+                "INSERT INTO llm_moderation_categories (code, label, description, severity, \
+                 created_at_ms)
+                 SELECT code, label, description, severity, created_at_ms
+                 FROM UNNEST($1::text[], $2::text[], $3::text[], $4::text[], $5::bigint[])
+                     AS input(code, label, description, severity, created_at_ms)
+                 ON CONFLICT (code) DO NOTHING",
+                &[
+                    &code_values,
+                    &label_values,
+                    &description_values,
+                    &severity_values,
+                    &created_at_values,
+                ],
+            )
+            .await
+            .context("insert postgres moderation categories")?;
+        Ok(inserted as usize)
+    }
+
+    async fn delete_moderation_category(
+        &self,
+        code: &str,
+    ) -> anyhow::Result<Option<ModerationCategory>> {
+        self.ensure_connection_alive()?;
+        // Refuse deletion while any keyword still references the category, so a
+        // keyword can never point at a dangling code.
+        let referenced: bool = self
+            .client
+            .query_one(
+                "SELECT EXISTS(
+                    SELECT 1 FROM llm_moderation_keywords WHERE category_codes ? $1
+                )",
+                &[&code],
+            )
+            .await
+            .context("check postgres moderation category references")?
+            .get(0);
+        if referenced {
+            anyhow::bail!("category `{code}` is still referenced by one or more keywords");
+        }
+        let sql = format!(
+            "DELETE FROM llm_moderation_categories WHERE code = $1
+             RETURNING {MODERATION_CATEGORY_COLUMNS}"
+        );
+        let row = self
+            .client
+            .query_opt(&sql, &[&code])
+            .await
+            .context("delete postgres moderation category")?;
+        Ok(row.as_ref().map(moderation_category_from_row))
+    }
+
+    async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>> {
+        self.ensure_connection_alive()?;
+        let sql = format!(
+            "SELECT {MODERATION_KEYWORD_COLUMNS} FROM llm_moderation_keywords ORDER BY id DESC"
+        );
+        let rows = self
+            .client
+            .query(&sql, &[])
+            .await
+            .context("list postgres moderation keywords")?;
+        Ok(rows.iter().map(moderation_keyword_from_row).collect())
+    }
+
+    async fn add_moderation_keywords(
+        &self,
+        keywords: Vec<NewModerationKeyword>,
+    ) -> anyhow::Result<ModerationKeywordImportOutcome> {
+        self.ensure_connection_alive()?;
+        if keywords.is_empty() {
+            return Ok(ModerationKeywordImportOutcome::default());
+        }
+        let total = keywords.len();
+        let mut keyword_values = Vec::with_capacity(total);
+        let mut note_values = Vec::with_capacity(total);
+        let mut source_values = Vec::with_capacity(total);
+        let mut category_values = Vec::with_capacity(total);
+        let mut created_at_values = Vec::with_capacity(total);
+        for keyword in keywords {
+            keyword_values.push(keyword.keyword);
+            note_values.push(keyword.note.unwrap_or_default());
+            source_values.push(keyword.source);
+            category_values.push(category_codes_to_json(&keyword.categories));
+            created_at_values.push(keyword.created_at_ms);
+        }
+        let inserted = self
+            .client
+            .execute(
+                "INSERT INTO llm_moderation_keywords (keyword, note, source, category_codes, \
+                 created_at_ms)
+                 SELECT keyword, NULLIF(note, ''), source, category_codes::jsonb, created_at_ms
+                 FROM UNNEST($1::text[], $2::text[], $3::text[], $4::text[], $5::bigint[])
+                     AS input(keyword, note, source, category_codes, created_at_ms)
+                 ON CONFLICT (keyword) DO NOTHING",
+                &[
+                    &keyword_values,
+                    &note_values,
+                    &source_values,
+                    &category_values,
+                    &created_at_values,
+                ],
+            )
+            .await
+            .context("insert postgres moderation keywords")? as usize;
+        Ok(ModerationKeywordImportOutcome {
+            inserted,
+            duplicates: total.saturating_sub(inserted),
+        })
+    }
+
+    async fn delete_moderation_keyword(
+        &self,
+        id: i64,
+    ) -> anyhow::Result<Option<ModerationKeyword>> {
+        self.ensure_connection_alive()?;
+        let sql = format!(
+            "DELETE FROM llm_moderation_keywords WHERE id = $1
+             RETURNING {MODERATION_KEYWORD_COLUMNS}"
+        );
+        let row = self
+            .client
+            .query_opt(&sql, &[&id])
+            .await
+            .context("delete postgres moderation keyword")?;
+        Ok(row.as_ref().map(moderation_keyword_from_row))
+    }
+
+    async fn record_moderation_banned_session(
+        &self,
+        record: NewModerationBannedSession,
+    ) -> anyhow::Result<bool> {
+        self.ensure_connection_alive()?;
+        let inserted = self
+            .client
+            .execute(
+                "INSERT INTO llm_moderation_banned_sessions (
+                    hit_key,
+                    session_key,
+                    provider,
+                    key_id,
+                    key_name,
+                    session_id,
+                    matched_keyword,
+                    matched_context,
+                    match_start,
+                    match_end,
+                    match_prefix_sha256,
+                    keyword_set_hash,
+                    endpoint,
+                    model,
+                    client_ip,
+                    request_headers_json,
+                    request_body_json,
+                    matched_categories,
+                    status,
+                    banned_at_ms,
+                    updated_at_ms
+                 )
+                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
+                         $13, $14, $15, $16, $17, $18::jsonb, 'banned', $19, $19)
+                 ON CONFLICT (hit_key) DO NOTHING",
+                &[
+                    &record.hit_key,
+                    &record.session_key,
+                    &record.provider,
+                    &record.key_id,
+                    &record.key_name,
+                    &record.session_id,
+                    &record.matched_keyword,
+                    &record.matched_context,
+                    &record.match_start,
+                    &record.match_end,
+                    &record.match_prefix_sha256,
+                    &record.keyword_set_hash,
+                    &record.endpoint,
+                    &record.model,
+                    &record.client_ip,
+                    &record.request_headers_json,
+                    &record.request_body_json,
+                    &category_codes_to_json(&record.matched_categories),
+                    &record.banned_at_ms,
+                ],
+            )
+            .await
+            .context("record postgres moderation banned session")?;
+        Ok(inserted > 0)
+    }
+
+    async fn list_moderation_banned_sessions(
+        &self,
+        page: AdminPageRequest,
+        status: Option<&str>,
+    ) -> anyhow::Result<ModerationBannedSessionsPage> {
+        self.ensure_connection_alive()?;
+        let status = normalized_session_status_filter(status)?;
+        let limit = page.limit.max(1);
+        let limit_i64 = limit.min(i64::MAX as usize) as i64;
+        let offset_i64 = page.offset.min(i64::MAX as usize) as i64;
+        let (total, rows) = match status {
+            Some(status) => {
+                let total: i64 = self
+                    .client
+                    .query_one(
+                        "SELECT COUNT(*) FROM llm_moderation_banned_sessions WHERE status = $1",
+                        &[&status],
+                    )
+                    .await
+                    .context("count postgres moderation banned sessions")?
+                    .get(0);
+                let sql = format!(
+                    "SELECT {MODERATION_BANNED_SESSION_COLUMNS}
+                     FROM llm_moderation_banned_sessions
+                     WHERE status = $1
+                     ORDER BY banned_at_ms DESC, id DESC
+                     LIMIT $2 OFFSET $3"
+                );
+                let rows = self
+                    .client
+                    .query(&sql, &[&status, &limit_i64, &offset_i64])
+                    .await
+                    .context("list postgres moderation banned sessions")?;
+                (total, rows)
+            },
+            None => {
+                let total: i64 = self
+                    .client
+                    .query_one("SELECT COUNT(*) FROM llm_moderation_banned_sessions", &[])
+                    .await
+                    .context("count postgres moderation banned sessions")?
+                    .get(0);
+                let sql = format!(
+                    "SELECT {MODERATION_BANNED_SESSION_COLUMNS}
+                     FROM llm_moderation_banned_sessions
+                     ORDER BY banned_at_ms DESC, id DESC
+                     LIMIT $1 OFFSET $2"
+                );
+                let rows = self
+                    .client
+                    .query(&sql, &[&limit_i64, &offset_i64])
+                    .await
+                    .context("list postgres moderation banned sessions")?;
+                (total, rows)
+            },
+        };
+        let sessions: Vec<ModerationBannedSession> = rows
+            .iter()
+            .map(moderation_banned_session_from_row)
+            .collect();
+        let total = total.max(0) as usize;
+        Ok(ModerationBannedSessionsPage {
+            has_more: page.offset.saturating_add(sessions.len()) < total,
+            sessions,
+            total,
+            limit,
+            offset: page.offset,
+        })
+    }
+
+    async fn get_moderation_banned_session(
+        &self,
+        id: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSessionDetail>> {
+        self.ensure_connection_alive()?;
+        let sql = format!(
+            "SELECT {MODERATION_BANNED_SESSION_COLUMNS},
+                    request_headers_json,
+                    request_body_json
+             FROM llm_moderation_banned_sessions
+             WHERE id = $1"
+        );
+        let Some(row) = self
+            .client
+            .query_opt(&sql, &[&id])
+            .await
+            .context("load postgres moderation banned session")?
+        else {
+            return Ok(None);
+        };
+        Ok(Some(ModerationBannedSessionDetail {
+            session: moderation_banned_session_from_row(&row),
+            request_headers_json: row.get(22),
+            request_body_json: row.get(23),
+        }))
+    }
+
+    async fn set_moderation_banned_session_status(
+        &self,
+        id: i64,
+        status: &str,
+        review_note: Option<&str>,
+        reviewed_at_ms: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSession>> {
+        self.ensure_connection_alive()?;
+        if status != MODERATION_SESSION_STATUS_BANNED
+            && status != MODERATION_SESSION_STATUS_UNBANNED
+        {
+            anyhow::bail!("unsupported moderation session status `{status}`");
+        }
+        let review_note = review_note
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(str::to_string);
+        let sql = format!(
+            "UPDATE llm_moderation_banned_sessions
+             SET status = $2,
+                 review_note = COALESCE($3, review_note),
+                 reviewed_at_ms = $4,
+                 updated_at_ms = $5
+             WHERE id = $1
+             RETURNING {MODERATION_BANNED_SESSION_COLUMNS}"
+        );
+        let row = self
+            .client
+            .query_opt(&sql, &[&id, &status, &review_note, &reviewed_at_ms, &now_ms()])
+            .await
+            .context("update postgres moderation banned session status")?;
+        Ok(row.as_ref().map(moderation_banned_session_from_row))
+    }
+}
diff --git a/crates/llm-access/src/admin.rs b/crates/llm-access/src/admin.rs
index 883739f4..6162e014 100644
--- a/crates/llm-access/src/admin.rs
+++ b/crates/llm-access/src/admin.rs
@@ -21,6 +21,7 @@ use llm_access_anthropic_pool::is_private_or_loopback_ip;
 #[cfg(any(feature = "duckdb-runtime", feature = "duckdb-bundled"))]
 use llm_access_core::store::UsageEventSink;
 use llm_access_core::{
+    moderation as core_moderation,
     provider::{ProtocolFamily, ProviderType, RouteStrategy},
     store::{
         self as core_store, AdminAccountContributionRequest, AdminAccountGroupPatch,
@@ -116,6 +117,10 @@ const DEFAULT_ADMIN_REVIEW_QUEUE_LIMIT: usize = 50;
 const MAX_ADMIN_REVIEW_QUEUE_LIMIT: usize = 200;
 const DEFAULT_ADMIN_LIST_LIMIT: usize = 50;
 const MAX_ADMIN_LIST_LIMIT: usize = 200;
+/// Upper bound on keywords accepted in a single moderation import request.
+const MAX_MODERATION_KEYWORDS_PER_IMPORT: usize = 10_000;
+/// Upper bound on the character length of a single moderation keyword.
+const MAX_MODERATION_KEYWORD_CHARS: usize = 512;
 const DEFAULT_ADMIN_IMPORT_JOB_LIMIT: usize = 20;
 const MAX_ADMIN_IMPORT_JOB_LIMIT: usize = 50;
 const PROXY_CONNECTIVITY_CHECK_TIMEOUT_SECONDS: u64 = 10;
@@ -3076,6 +3081,449 @@ pub(crate) async fn test_admin_anthropic_upstream_model(
     }
 }
 
+#[derive(Debug, Serialize)]
+struct AdminModerationKeywordsResponse {
+    keywords: Vec<core_store::ModerationKeyword>,
+    total: usize,
+    stats: crate::moderation::ModerationGateStats,
+    generated_at: i64,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct AddAdminModerationKeywordsRequest {
+    /// Raw payload to parse. When `format` is `json` it must be valid keyword
+    /// JSON; otherwise it is parsed line-by-line as plain text.
+    content: String,
+    /// `txt` (default) or `json`.
+    #[serde(default)]
+    format: Option<String>,
+    /// Optional shared note applied to every imported keyword.
+    #[serde(default)]
+    note: Option<String>,
+    /// Risk-category codes applied to every keyword in this import (must be
+    /// codes that already exist in the category taxonomy).
+    #[serde(default)]
+    categories: Vec<String>,
+}
+
+#[derive(Debug, Serialize)]
+struct AddAdminModerationKeywordsResponse {
+    inserted: usize,
+    duplicates: usize,
+    parsed: usize,
+    generated_at: i64,
+}
+
+#[derive(Debug, Serialize)]
+struct AdminModerationCategoriesResponse {
+    categories: Vec<core_store::ModerationCategory>,
+    generated_at: i64,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct AddAdminModerationCategoriesRequest {
+    categories: Vec<AdminModerationCategoryInput>,
+}
+
+#[derive(Debug, Deserialize)]
+struct AdminModerationCategoryInput {
+    code: String,
+    label: String,
+    #[serde(default)]
+    description: Option<String>,
+    #[serde(default)]
+    severity: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+struct AddAdminModerationCategoriesResponse {
+    inserted: usize,
+    generated_at: i64,
+}
+
+pub(crate) async fn list_admin_moderation_categories(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .list_moderation_categories()
+        .await
+    {
+        Ok(categories) => Json(AdminModerationCategoriesResponse {
+            categories,
+            generated_at: now_ms(),
+        })
+        .into_response(),
+        Err(_) => internal_error("Failed to list moderation categories").into_response(),
+    }
+}
+
+pub(crate) async fn add_admin_moderation_categories(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Json(request): Json<AddAdminModerationCategoriesRequest>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    if request.categories.is_empty() {
+        return bad_request("no categories were provided").into_response();
+    }
+    let created_at_ms = now_ms();
+    let mut records = Vec::with_capacity(request.categories.len());
+    for input in request.categories {
+        let code = input.code.trim().to_ascii_lowercase();
+        if code.is_empty() || !code.chars().all(|c| c.is_ascii_alphanumeric() || c == '_') {
+            return bad_request(
+                "category code must be non-empty and use only [a-z0-9_] characters",
+            )
+            .into_response();
+        }
+        let label = input.label.trim().to_string();
+        if label.is_empty() {
+            return bad_request("category label must not be empty").into_response();
+        }
+        let severity = input
+            .severity
+            .as_deref()
+            .map(str::trim)
+            .map(str::to_ascii_lowercase)
+            .unwrap_or_else(|| core_store::MODERATION_CATEGORY_SEVERITY_MEDIUM.to_string());
+        if !matches!(severity.as_str(), "critical" | "high" | "medium" | "low") {
+            return bad_request("severity must be one of critical/high/medium/low").into_response();
+        }
+        records.push(core_store::NewModerationCategory {
+            code,
+            label,
+            description: input.description.unwrap_or_default().trim().to_string(),
+            severity,
+            created_at_ms,
+        });
+    }
+    match state
+        .admin_moderation_store
+        .add_moderation_categories(records)
+        .await
+    {
+        Ok(inserted) => Json(AddAdminModerationCategoriesResponse {
+            inserted,
+            generated_at: now_ms(),
+        })
+        .into_response(),
+        Err(_) => internal_error("Failed to add moderation categories").into_response(),
+    }
+}
+
+pub(crate) async fn delete_admin_moderation_category(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Path(code): Path<String>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .delete_moderation_category(&code)
+        .await
+    {
+        Ok(Some(category)) => Json(DeleteResponse {
+            deleted: true,
+            id: category.code,
+        })
+        .into_response(),
+        Ok(None) => not_found("Moderation category not found").into_response(),
+        Err(err) => conflict(&err.to_string()).into_response(),
+    }
+}
+
+#[derive(Debug, Serialize)]
+struct AdminModerationBannedSessionsResponse {
+    sessions: Vec<core_store::ModerationBannedSession>,
+    total: usize,
+    limit: usize,
+    offset: usize,
+    has_more: bool,
+    generated_at: i64,
+}
+
+#[derive(Debug, Deserialize, Default)]
+pub(crate) struct AdminModerationBannedSessionsQuery {
+    limit: Option<usize>,
+    offset: Option<usize>,
+    status: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct ReviewAdminModerationBannedSessionRequest {
+    /// `true` keeps this hit banned, `false` suppresses this reviewed hit.
+    banned: bool,
+    #[serde(default)]
+    review_note: Option<String>,
+}
+
+pub(crate) async fn list_admin_moderation_keywords(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .list_moderation_keywords()
+        .await
+    {
+        Ok(keywords) => Json(AdminModerationKeywordsResponse {
+            total: keywords.len(),
+            keywords,
+            stats: state.moderation_gate.stats(),
+            generated_at: now_ms(),
+        })
+        .into_response(),
+        Err(_) => internal_error("Failed to list moderation keywords").into_response(),
+    }
+}
+
+pub(crate) async fn add_admin_moderation_keywords(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Json(request): Json<AddAdminModerationKeywordsRequest>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    let format = request
+        .format
+        .as_deref()
+        .map(str::trim)
+        .map(str::to_ascii_lowercase)
+        .unwrap_or_else(|| core_store::MODERATION_KEYWORD_SOURCE_TXT.to_string());
+    let (source, parsed) = match format.as_str() {
+        core_store::MODERATION_KEYWORD_SOURCE_JSON => {
+            match core_moderation::parse_moderation_keywords_json(&request.content) {
+                Ok(keywords) => (core_store::MODERATION_KEYWORD_SOURCE_JSON, keywords),
+                Err(err) => return bad_request(&err.to_string()).into_response(),
+            }
+        },
+        core_store::MODERATION_KEYWORD_SOURCE_TXT | "text" | "" => (
+            core_store::MODERATION_KEYWORD_SOURCE_TXT,
+            core_moderation::parse_moderation_keywords_txt(&request.content),
+        ),
+        other => {
+            return bad_request(&format!("unsupported keyword format `{other}`")).into_response()
+        },
+    };
+    if parsed.is_empty() {
+        return bad_request("no keywords were parsed from the payload").into_response();
+    }
+    if parsed.len() > MAX_MODERATION_KEYWORDS_PER_IMPORT {
+        return bad_request(&format!(
+            "too many keywords in one import ({}); limit is {MAX_MODERATION_KEYWORDS_PER_IMPORT}",
+            parsed.len()
+        ))
+        .into_response();
+    }
+    if let Some(oversized) = parsed
+        .iter()
+        .find(|keyword| keyword.chars().count() > MAX_MODERATION_KEYWORD_CHARS)
+    {
+        return bad_request(&format!(
+            "a keyword exceeds the {MAX_MODERATION_KEYWORD_CHARS}-character limit: {}…",
+            oversized.chars().take(40).collect::<String>()
+        ))
+        .into_response();
+    }
+    // Normalize + validate the batch-level categories against the taxonomy so a
+    // keyword can never reference a category that does not exist.
+    let mut categories: Vec<String> = request
+        .categories
+        .iter()
+        .map(|code| code.trim().to_string())
+        .filter(|code| !code.is_empty())
+        .collect();
+    categories.sort();
+    categories.dedup();
+    if !categories.is_empty() {
+        let known = match state
+            .admin_moderation_store
+            .list_moderation_categories()
+            .await
+        {
+            Ok(known) => known,
+            Err(_) => {
+                return internal_error("Failed to load moderation categories").into_response()
+            },
+        };
+        let known: std::collections::HashSet<&str> = known
+            .iter()
+            .map(|category| category.code.as_str())
+            .collect();
+        if let Some(unknown) = categories
+            .iter()
+            .find(|code| !known.contains(code.as_str()))
+        {
+            return bad_request(&format!("unknown category code `{unknown}`")).into_response();
+        }
+    }
+    let note = request
+        .note
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(str::to_string);
+    let parsed_count = parsed.len();
+    let created_at_ms = now_ms();
+    let records: Vec<core_store::NewModerationKeyword> = parsed
+        .into_iter()
+        .map(|keyword| core_store::NewModerationKeyword {
+            keyword,
+            categories: categories.clone(),
+            note: note.clone(),
+            source: source.to_string(),
+            created_at_ms,
+        })
+        .collect();
+    match state
+        .admin_moderation_store
+        .add_moderation_keywords(records)
+        .await
+    {
+        Ok(outcome) => {
+            reload_moderation_gate(&state).await;
+            Json(AddAdminModerationKeywordsResponse {
+                inserted: outcome.inserted,
+                duplicates: outcome.duplicates,
+                parsed: parsed_count,
+                generated_at: now_ms(),
+            })
+            .into_response()
+        },
+        Err(_) => internal_error("Failed to import moderation keywords").into_response(),
+    }
+}
+
+pub(crate) async fn delete_admin_moderation_keyword(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .delete_moderation_keyword(id)
+        .await
+    {
+        Ok(Some(keyword)) => {
+            reload_moderation_gate(&state).await;
+            Json(DeleteResponse {
+                deleted: true,
+                id: keyword.id.to_string(),
+            })
+            .into_response()
+        },
+        Ok(None) => not_found("Moderation keyword not found").into_response(),
+        Err(_) => internal_error("Failed to delete moderation keyword").into_response(),
+    }
+}
+
+pub(crate) async fn list_admin_moderation_banned_sessions(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Query(query): Query<AdminModerationBannedSessionsQuery>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    let page_request = core_store::AdminPageRequest {
+        limit: query
+            .limit
+            .unwrap_or(DEFAULT_ADMIN_LIST_LIMIT)
+            .clamp(1, MAX_ADMIN_LIST_LIMIT),
+        offset: query.offset.unwrap_or(0),
+    };
+    let status = query
+        .status
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty() && *value != "all");
+    match state
+        .admin_moderation_store
+        .list_moderation_banned_sessions(page_request, status)
+        .await
+    {
+        Ok(page) => Json(AdminModerationBannedSessionsResponse {
+            sessions: page.sessions,
+            total: page.total,
+            limit: page.limit,
+            offset: page.offset,
+            has_more: page.has_more,
+            generated_at: now_ms(),
+        })
+        .into_response(),
+        Err(_) => internal_error("Failed to list banned sessions").into_response(),
+    }
+}
+
+pub(crate) async fn get_admin_moderation_banned_session(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .get_moderation_banned_session(id)
+        .await
+    {
+        Ok(Some(detail)) => Json(detail).into_response(),
+        Ok(None) => not_found("Banned session not found").into_response(),
+        Err(_) => internal_error("Failed to load banned session").into_response(),
+    }
+}
+
+pub(crate) async fn review_admin_moderation_banned_session(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+    Json(request): Json<ReviewAdminModerationBannedSessionRequest>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    let status = if request.banned {
+        core_store::MODERATION_SESSION_STATUS_BANNED
+    } else {
+        core_store::MODERATION_SESSION_STATUS_UNBANNED
+    };
+    match state
+        .admin_moderation_store
+        .set_moderation_banned_session_status(id, status, request.review_note.as_deref(), now_ms())
+        .await
+    {
+        Ok(Some(session)) => {
+            reload_moderation_gate(&state).await;
+            Json(session).into_response()
+        },
+        Ok(None) => not_found("Banned session not found").into_response(),
+        Err(_) => internal_error("Failed to review banned session").into_response(),
+    }
+}
+
+async fn reload_moderation_gate(state: &HttpState) {
+    if let Err(err) = state.moderation_gate.reload().await {
+        tracing::warn!("failed to reload moderation gate after admin change: {err:#}");
+    }
+}
+
 pub(crate) fn kiro_cache_simulation_config_from_admin_config(
     config: &AdminRuntimeConfig,
 ) -> KiroCacheSimulationConfig {
diff --git a/crates/llm-access/src/lib.rs b/crates/llm-access/src/lib.rs
index dd279374..131f5e9b 100644
--- a/crates/llm-access/src/lib.rs
+++ b/crates/llm-access/src/lib.rs
@@ -19,6 +19,8 @@ mod kiro_headers;
 mod kiro_latency;
 mod kiro_refresh;
 mod kiro_status;
+/// Keyword moderation gate.
+pub mod moderation;
 mod process_memory;
 /// Provider request entrypoints.
 pub mod provider;
@@ -63,10 +65,11 @@ use llm_access_codex_image::{
 };
 use llm_access_core::store::{
     AdminAccountGroupStore, AdminAnthropicUpstreamStore, AdminCodexAccountStore, AdminConfigStore,
-    AdminKeyStore, AdminKiroAccountStore, AdminProxyStore, AdminReviewQueueStore,
-    PublicAccessStore, PublicCommunityStore, PublicStatusStore, PublicSubmissionStore,
-    PublicUsageStore,
+    AdminKeyStore, AdminKiroAccountStore, AdminModerationStore, AdminProxyStore,
+    AdminReviewQueueStore, PublicAccessStore, PublicCommunityStore, PublicStatusStore,
+    PublicSubmissionStore, PublicUsageStore,
 };
+use moderation::ModerationGate;
 use serde::Serialize;
 use tokio::sync::Semaphore;
 use tower_http::cors::{Any, CorsLayer};
@@ -91,6 +94,8 @@ struct HttpState {
     admin_codex_account_store: Arc<dyn AdminCodexAccountStore>,
     admin_kiro_account_store: Arc<dyn AdminKiroAccountStore>,
     admin_anthropic_upstream_store: Arc<dyn AdminAnthropicUpstreamStore>,
+    admin_moderation_store: Arc<dyn AdminModerationStore>,
+    moderation_gate: Arc<ModerationGate>,
     admin_review_queue_store: Arc<dyn AdminReviewQueueStore>,
     public_access_store: Arc<dyn PublicAccessStore>,
     public_community_store: Arc<dyn PublicCommunityStore>,
@@ -196,7 +201,7 @@ pub fn router_with_simulator(
 ) -> (Router, Arc<llm_access_kiro::cache_sim::KiroCacheSimulator>) {
     let request_activity = Arc::new(activity::RequestActivityTracker::new());
     let geoip = runtime.geoip();
-    let provider_state = provider::ProviderState::new_with_config_store_activity_and_latency(
+    let mut provider_state = provider::ProviderState::new_with_config_store_activity_and_latency(
         runtime.control_store(),
         runtime.provider_route_store(),
         runtime.admin_config_store(),
@@ -204,6 +209,11 @@ pub fn router_with_simulator(
         geoip.clone(),
         runtime.kiro_latency_ranker(),
     );
+    let moderation_gate = ModerationGate::new(runtime.admin_moderation_store());
+    provider_state.set_moderation_gate(Arc::clone(&moderation_gate));
+    if let Ok(handle) = tokio::runtime::Handle::try_current() {
+        handle.spawn(Arc::clone(&moderation_gate).run_refresh_loop());
+    }
     let codex_image_gateway = Arc::new(
         CodexImageGateway::new(CodexImageGatewayConfig {
             mode: ImageGatewayMode::IntegratedCodexApi,
@@ -230,6 +240,8 @@ pub fn router_with_simulator(
         admin_codex_account_store: runtime.admin_codex_account_store(),
         admin_kiro_account_store: runtime.admin_kiro_account_store(),
         admin_anthropic_upstream_store: runtime.admin_anthropic_upstream_store(),
+        admin_moderation_store: runtime.admin_moderation_store(),
+        moderation_gate,
         admin_review_queue_store: runtime.admin_review_queue_store(),
         public_access_store: runtime.public_access_store(),
         public_community_store: runtime.public_community_store(),
@@ -434,6 +446,35 @@ pub fn router_with_simulator(
             "/admin/kiro-gateway/anthropic-upstreams/:name/test",
             post(admin::test_admin_anthropic_upstream_model),
         )
+        .route(
+            "/admin/llm-gateway/moderation/categories",
+            get(admin::list_admin_moderation_categories)
+                .post(admin::add_admin_moderation_categories),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/categories/:code",
+            delete(admin::delete_admin_moderation_category),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/keywords",
+            get(admin::list_admin_moderation_keywords).post(admin::add_admin_moderation_keywords),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/keywords/:id",
+            delete(admin::delete_admin_moderation_keyword),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/banned-sessions",
+            get(admin::list_admin_moderation_banned_sessions),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/banned-sessions/:id",
+            get(admin::get_admin_moderation_banned_session),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/banned-sessions/:id/review",
+            post(admin::review_admin_moderation_banned_session),
+        )
         .route(
             "/admin/kiro-gateway/accounts",
             get(admin::list_admin_kiro_accounts).post(admin::create_admin_kiro_manual_account),
diff --git a/crates/llm-access/src/moderation.rs b/crates/llm-access/src/moderation.rs
new file mode 100644
index 00000000..8a8e0e43
--- /dev/null
+++ b/crates/llm-access/src/moderation.rs
@@ -0,0 +1,1084 @@
+//! In-memory keyword moderation gate enforced before upstream dispatch.
+//!
+//! This module is the request-side half of keyword moderation. The matching
+//! algorithm itself lives in [`llm_access_core::moderation`]; here we own the
+//! *caching contract* and the *per-request decision flow* that wrap it, for
+//! both the Kiro and Codex provider surfaces.
+//!
+//! # Where the data lives (caching contract)
+//!
+//! The hot path reads only process memory and never queries Postgres. Postgres
+//! is the durable control plane: read on startup / periodic refresh / admin
+//! change, and written exactly once per *newly* banned hit.
+//!
+//! ```text
+//!   ┌──────────────────── in process memory (RwLock<ModerationGateState>) ────────────────┐
+//!   │  matcher : Aho-Corasick automaton compiled from every keyword                        │
+//!   │  banned  : HashSet<session_key>     suppressed_hit_keys : HashSet<hit_key>            │
+//!   └─────────────────────────────────────────────────────────────────────────────────────┘
+//!        ▲ reload(): full snapshot  — startup, every N minutes, and after any admin change
+//!        │ ban_session(): ONE spawned INSERT per new ban (body + headers), off the hot path
+//!        ▼
+//!   ┌──────────────────────────────── Postgres (control plane) ───────────────────────────┐
+//!   │  llm_moderation_keywords              llm_moderation_banned_sessions                  │
+//!   └─────────────────────────────────────────────────────────────────────────────────────┘
+//! ```
+//!
+//! # Per-request decision flow ([`enforce_moderation`])
+//!
+//! Every provider hook funnels through one function so the three call sites
+//! (Kiro-native, direct-Anthropic, Codex) stay identical. Work is done lazily:
+//! a dormant gate costs nothing, an already-banned session is rejected without
+//! scanning or writing, and the body is only tokenized/scanned when a keyword
+//! could actually match.
+//!
+//! ```text
+//!   request
+//!     │
+//!     ▼
+//!   is_active()? ──no──▶ ALLOW                         dormant gate (no keywords, no bans):
+//!     │ yes                                            no key derivation, no scan, no I/O
+//!     ▼
+//!   session_key = explicit session id, else SHA-256(body)   (content-scoped, dedups retries)
+//!     │
+//!     ▼
+//!   precheck(session_key)
+//!     ├── Blocked  (session already banned) ─────────▶ BLOCK   (no scan, no DB write)
+//!     ├── Skip     (no keywords) ───────────────────▶ ALLOW
+//!     └── Scan(automaton + suppressed hit keys)
+//!            │
+//!            ▼  extract user-visible text ─▶ tokenize ─▶ scan, skipping suppressed hit_keys
+//!          unsuppressed hit? ──no──▶ ALLOW
+//!            │ yes
+//!            ▼  ban_session(): insert into `banned` (memory) + spawn one Postgres capture
+//!          BLOCK  ──▶ caller returns the provider-specific rejection (Kiro/Codex error shape)
+//! ```
+//!
+//! A `BLOCK` decision stops this and every subsequent request for the session:
+//! the key is now in the in-memory `banned` set, so the next request short-
+//! circuits at `precheck` without touching the body or Postgres. When a
+//! reviewer reviews a hit as `unbanned` via the admin API, that hit's `hit_key`
+//! becomes suppressed; the session leaves the `banned` set and is re-scanned,
+//! and the scan skips only that exact hit (by identity, folding in the content
+//! prefix), so a distinct keyword — even one sharing the same offset — and
+//! later content can still be scanned and banned.
+//!
+//! # Hit-scoped unban: why we skip by hit identity, not by position
+//!
+//! A ban is scoped to one *hit*, not the whole session, so a reviewer clearing
+//! a single false positive neither unblocks the session wholesale nor masks
+//! other matches. A hit's identity is `hit_key`
+//! (`moderation_hit_key` = `sha256(session_key ∥ keyword ∥ start ∥ end ∥
+//! sha256(text_prefix))`). Reviewing a hit as `unbanned` records its `hit_key`
+//! in the `suppressed_hit_keys` set. Folding the *preceding-content* hash into
+//! the key makes suppression fail-closed on any content change: if the text
+//! before the match differs by a single byte, the `hit_key` differs and the hit
+//! re-fires. Including the keyword and offsets makes two matches at the same
+//! place distinct keys.
+//!
+//! The scan therefore enumerates *every* term-boundary hit
+//! ([`ModerationMatcher::find_accepted`]) and blocks on the first whose
+//! `hit_key` is **not** suppressed. It deliberately does **not** try to resume
+//! the scan past a reviewed position, because position-based skipping is a
+//! content-policy bypass (fail-open) when keywords overlap:
+//!
+//! ```text
+//!   keywords: "bomb", "bomb making"         request text: "... bomb making ..."
+//!   both hit the SAME start offset S (one is a term-prefix of the other).
+//!
+//!   WRONG (skip by position): unban "bomb"@S ⇒ suppressed.
+//!     next scan finds "bomb"@S (suppressed) ⇒ advance past offset S ⇒
+//!     the DISTINCT, never-reviewed "bomb making"@S is skipped too ⇒ ALLOW ✗
+//!     (a longer keyword *starting before* a resumed offset is skipped the
+//!      same way.)
+//!
+//!   RIGHT (skip by hit_key): unban "bomb"@S ⇒ only hit_key(bomb@S) suppressed.
+//!     next scan enumerates both hits at S; "bomb"@S is suppressed, but
+//!     "bomb making"@S has a different hit_key ⇒ BLOCK ✓
+//! ```
+//!
+//! A session with any still-`banned` hit stays in the `banned` set (blocked at
+//! `precheck`); only when *all* its hits are `unbanned` does the store's
+//! `SELECT DISTINCT session_key WHERE status = 'banned'` drop it and let the
+//! gate re-scan. Because a session can therefore accumulate several ban rows
+//! over time, uniqueness is per hit (`hit_key UNIQUE`), never per
+//! `session_key`.
+
+use std::{
+    collections::HashSet,
+    fmt::Write as _,
+    sync::{
+        atomic::{AtomicU64, Ordering},
+        Arc, RwLock,
+    },
+    time::Duration,
+};
+
+use axum::http::HeaderMap;
+use llm_access_core::{
+    moderation::{
+        extract_moderation_text, normalize_moderation_text, ModerationMatch, ModerationMatcher,
+    },
+    store::{
+        AdminModerationStore, AuthenticatedKey, EmptyAdminModerationStore, ModerationKeyword,
+        NewModerationBannedSession,
+    },
+};
+use llm_access_kiro::anthropic::types::MessagesRequest;
+use serde::Serialize;
+use sha2::{Digest, Sha256};
+
+/// Provider label recorded for Kiro-surface bans (native and direct Anthropic
+/// upstream dispatch).
+pub(crate) const MODERATION_PROVIDER_KIRO: &str = "kiro";
+/// Provider label recorded for Codex-surface bans.
+pub(crate) const MODERATION_PROVIDER_CODEX: &str = "codex";
+
+/// Client-facing rejection message for moderated sessions.
+pub(crate) const MODERATION_BLOCKED_MESSAGE: &str = "This session has been blocked by the gateway \
+                                                     content policy. Contact the administrator if \
+                                                     you believe this is a mistake.";
+
+const MODERATION_REFRESH_INTERVAL_ENV: &str = "LLM_ACCESS_MODERATION_REFRESH_SECONDS";
+const DEFAULT_MODERATION_REFRESH_INTERVAL: Duration = Duration::from_secs(300);
+
+/// Header names whose values are redacted before a ban record is persisted.
+const REDACTED_HEADER_NAMES: [&str; 5] =
+    ["authorization", "proxy-authorization", "x-api-key", "x-admin-token", "cookie"];
+
+/// Hot-path decision for one request before any keyword scan runs.
+pub(crate) enum ModerationPrecheck {
+    /// Session key is already banned: reject without scanning or writing.
+    Blocked,
+    /// The gate has no keywords / no loaded snapshot yet: skip scanning.
+    Skip,
+    /// Scan the request text with the compiled automaton.
+    Scan(ModerationScanPlan),
+}
+
+pub(crate) struct ModerationScanPlan {
+    matcher: Arc<ModerationMatcher>,
+    keyword_set_hash: String,
+    suppressed_hit_keys: Arc<HashSet<String>>,
+}
+
+#[derive(Default)]
+struct ModerationGateState {
+    matcher: Option<Arc<ModerationMatcher>>,
+    keyword_count: usize,
+    banned: HashSet<String>,
+    suppressed_hit_keys: Arc<HashSet<String>>,
+    keyword_set_hash: String,
+    loaded: bool,
+    loaded_at_ms: Option<i64>,
+}
+
+/// Runtime counters and cache sizes surfaced on the admin overview.
+#[derive(Debug, Clone, Serialize)]
+pub(crate) struct ModerationGateStats {
+    pub loaded: bool,
+    pub loaded_at_ms: Option<i64>,
+    pub keyword_count: usize,
+    pub banned_session_count: usize,
+    pub suppressed_hit_count: usize,
+    pub blocked_requests_total: u64,
+    pub persist_failures_total: u64,
+}
+
+/// Shared keyword moderation gate. See module docs for the caching contract.
+pub struct ModerationGate {
+    store: Arc<dyn AdminModerationStore>,
+    state: RwLock<ModerationGateState>,
+    blocked_requests_total: AtomicU64,
+    persist_failures_total: Arc<AtomicU64>,
+}
+
+impl ModerationGate {
+    /// Create a gate backed by a persistent moderation store. The gate starts
+    /// unloaded (fail-open) until the first [`Self::reload`] succeeds.
+    pub fn new(store: Arc<dyn AdminModerationStore>) -> Arc<Self> {
+        Arc::new(Self {
+            store,
+            state: RwLock::new(ModerationGateState::default()),
+            blocked_requests_total: AtomicU64::new(0),
+            persist_failures_total: Arc::new(AtomicU64::new(0)),
+        })
+    }
+
+    /// Create a permanently empty gate for tests and store-less runtimes.
+    pub fn disabled() -> Arc<Self> {
+        let gate = Self::new(Arc::new(EmptyAdminModerationStore));
+        {
+            let mut state = gate.state.write().expect("moderation gate lock poisoned");
+            state.loaded = true;
+        }
+        gate
+    }
+
+    /// Reload the keyword automaton and session sets from the store.
+    pub async fn reload(&self) -> anyhow::Result<()> {
+        let snapshot = self.store.load_moderation_runtime_snapshot().await?;
+        let keyword_set_hash = moderation_keyword_set_hash(&snapshot.keywords);
+        let matcher = ModerationMatcher::build(
+            snapshot
+                .keywords
+                .iter()
+                .map(|keyword| (keyword.keyword.as_str(), keyword.categories.clone())),
+        )?
+        .map(Arc::new);
+        let keyword_count = matcher
+            .as_ref()
+            .map(|matcher| matcher.pattern_count())
+            .unwrap_or(0);
+        let suppressed_hit_keys: HashSet<String> = snapshot
+            .suppressed_hits
+            .into_iter()
+            .map(|hit| hit.hit_key)
+            .collect();
+        let mut state = self.state.write().expect("moderation gate lock poisoned");
+        state.matcher = matcher;
+        state.keyword_count = keyword_count;
+        state.banned = snapshot.banned_session_keys.into_iter().collect();
+        state.suppressed_hit_keys = Arc::new(suppressed_hit_keys);
+        state.keyword_set_hash = keyword_set_hash;
+        state.loaded = true;
+        state.loaded_at_ms = Some(now_ms());
+        Ok(())
+    }
+
+    /// Reload immediately, then keep the snapshot fresh on a fixed interval as
+    /// a safety net for out-of-band store changes.
+    pub async fn run_refresh_loop(self: Arc<Self>) {
+        let interval = moderation_refresh_interval();
+        loop {
+            match self.reload().await {
+                Ok(()) => {
+                    let stats = self.stats();
+                    tracing::debug!(
+                        keyword_count = stats.keyword_count,
+                        banned_session_count = stats.banned_session_count,
+                        suppressed_hit_count = stats.suppressed_hit_count,
+                        "moderation gate snapshot refreshed"
+                    );
+                },
+                Err(err) => {
+                    tracing::warn!("moderation gate snapshot refresh failed: {err:#}");
+                },
+            }
+            tokio::time::sleep(interval).await;
+        }
+    }
+
+    /// Whether the gate can affect any request. Dormant means loaded with no
+    /// keywords and no banned sessions, or not loaded yet — in which case the
+    /// hot path can skip all moderation work (session-key derivation, text
+    /// extraction, and scanning) entirely.
+    pub(crate) fn is_active(&self) -> bool {
+        let state = self.state.read().expect("moderation gate lock poisoned");
+        state.loaded && (state.matcher.is_some() || !state.banned.is_empty())
+    }
+
+    /// Classify one request before scanning.
+    pub(crate) fn precheck(&self, session_key: Option<&str>) -> ModerationPrecheck {
+        let state = self.state.read().expect("moderation gate lock poisoned");
+        if !state.loaded {
+            return ModerationPrecheck::Skip;
+        }
+        if let Some(session_key) = session_key {
+            if state.banned.contains(session_key) {
+                return ModerationPrecheck::Blocked;
+            }
+        }
+        match &state.matcher {
+            Some(matcher) => ModerationPrecheck::Scan(ModerationScanPlan {
+                matcher: Arc::clone(matcher),
+                keyword_set_hash: state.keyword_set_hash.clone(),
+                suppressed_hit_keys: Arc::clone(&state.suppressed_hit_keys),
+            }),
+            None => ModerationPrecheck::Skip,
+        }
+    }
+
+    /// Count one rejected request (new ban or repeat block).
+    pub(crate) fn note_blocked_request(&self) {
+        self.blocked_requests_total.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Ban a session in memory and persist the capture exactly once. Repeat
+    /// calls for an already-banned session key never reach the store.
+    pub(crate) fn ban_session(&self, record: NewModerationBannedSession) {
+        let newly_banned = {
+            let mut state = self.state.write().expect("moderation gate lock poisoned");
+            state.state_ban(&record.session_key)
+        };
+        if !newly_banned {
+            return;
+        }
+        tracing::warn!(
+            session_key = %record.session_key,
+            provider = %record.provider,
+            key_id = %record.key_id,
+            matched_keyword = %record.matched_keyword,
+            endpoint = %record.endpoint,
+            "moderation keyword hit banned session"
+        );
+        let store = Arc::clone(&self.store);
+        let persist_failures = Arc::clone(&self.persist_failures_total);
+        tokio::spawn(async move {
+            let session_key = record.session_key.clone();
+            match store.record_moderation_banned_session(record).await {
+                Ok(true) => {},
+                Ok(false) => tracing::debug!(
+                    session_key = %session_key,
+                    "moderation banned session was already recorded"
+                ),
+                Err(err) => {
+                    persist_failures.fetch_add(1, Ordering::Relaxed);
+                    tracing::error!(
+                        session_key = %session_key,
+                        "failed to persist moderation banned session: {err:#}"
+                    );
+                },
+            }
+        });
+    }
+
+    /// Runtime stats for the admin overview.
+    pub(crate) fn stats(&self) -> ModerationGateStats {
+        let state = self.state.read().expect("moderation gate lock poisoned");
+        ModerationGateStats {
+            loaded: state.loaded,
+            loaded_at_ms: state.loaded_at_ms,
+            keyword_count: state.keyword_count,
+            banned_session_count: state.banned.len(),
+            suppressed_hit_count: state.suppressed_hit_keys.len(),
+            blocked_requests_total: self.blocked_requests_total.load(Ordering::Relaxed),
+            persist_failures_total: self.persist_failures_total.load(Ordering::Relaxed),
+        }
+    }
+}
+
+impl ModerationGateState {
+    fn state_ban(&mut self, session_key: &str) -> bool {
+        self.banned.insert(session_key.to_string())
+    }
+}
+
+/// Outcome of the moderation gate for one request.
+pub(crate) enum ModerationDecision {
+    /// Allow the request to proceed to upstream dispatch.
+    Allow,
+    /// Reject the request: the session is banned, either already or by a
+    /// keyword hit this call just recorded. The caller returns its
+    /// provider-specific rejection response.
+    Block,
+}
+
+/// Immutable request facts the gate needs to classify a request and, on a
+/// keyword hit, build the ban capture.
+pub(crate) struct ModerationRequest<'a> {
+    /// Provider family label ([`MODERATION_PROVIDER_KIRO`] / `_CODEX`).
+    pub provider: &'a str,
+    pub key: &'a AuthenticatedKey,
+    /// Explicit client session id when the request carried a stable one; the
+    /// gate falls back to a content-derived key otherwise.
+    pub session_id: Option<&'a str>,
+    pub endpoint: &'a str,
+    pub model: &'a str,
+    pub headers: &'a HeaderMap,
+    pub body: &'a [u8],
+    pub client_ip: &'a str,
+}
+
+/// Enforce the keyword moderation gate for one request, shared by every
+/// provider dispatch hook. `extract_text` yields the normalized text to scan
+/// and is invoked only when the gate must actually scan (keywords configured
+/// and the session is not already banned), so the caller
+/// pays the extraction cost only when it can change the outcome. Returns
+/// [`ModerationDecision::Block`] when the request must be rejected.
+pub(crate) fn enforce_moderation(
+    gate: &ModerationGate,
+    request: ModerationRequest<'_>,
+    extract_text: impl FnOnce() -> String,
+) -> ModerationDecision {
+    // Dormant gate (no keywords, no bans): do zero work — no key derivation,
+    // no text extraction, no scan.
+    if !gate.is_active() {
+        return ModerationDecision::Allow;
+    }
+    let session_key = match request.session_id {
+        Some(session_id) => {
+            moderation_session_key(request.provider, &request.key.key_id, session_id)
+        },
+        None => derived_moderation_session_key(request.provider, &request.key.key_id, request.body),
+    };
+    match gate.precheck(Some(&session_key)) {
+        ModerationPrecheck::Blocked => {
+            gate.note_blocked_request();
+            ModerationDecision::Block
+        },
+        ModerationPrecheck::Scan(plan) => {
+            let scanned = extract_text();
+            // Enumerate every term-boundary hit and block on the first whose
+            // hit_key is NOT suppressed. Suppression is per hit identity, so two
+            // distinct keywords sharing a start offset (a phrase-prefix and its
+            // superstring) are each evaluated — clearing one never masks the
+            // other. A suppressed hit is skipped only for the exact preceding
+            // content it was reviewed in, because its hit_key folds in the
+            // content prefix hash. See the module-level "Hit-scoped unban"
+            // section for why this must skip by hit_key, not by scan position.
+            let Some(hit) = plan.matcher.find_accepted(&scanned, |keyword, start, end| {
+                let candidate_hit_key =
+                    moderation_hit_key_parts(&session_key, &scanned, keyword, start, end);
+                !plan.suppressed_hit_keys.contains(&candidate_hit_key)
+            }) else {
+                return ModerationDecision::Allow;
+            };
+            let hit_key = moderation_hit_key(&session_key, &scanned, &hit);
+            let match_prefix_sha256 = moderation_match_prefix_sha256(&scanned, hit.match_start);
+            let match_start = hit.match_start.min(i64::MAX as usize) as i64;
+            let match_end = hit.match_end.min(i64::MAX as usize) as i64;
+            gate.note_blocked_request();
+            gate.ban_session(NewModerationBannedSession {
+                hit_key,
+                session_key,
+                provider: request.provider.to_string(),
+                key_id: request.key.key_id.clone(),
+                key_name: request.key.key_name.clone(),
+                session_id: request.session_id.unwrap_or_default().to_string(),
+                matched_keyword: hit.keyword,
+                matched_categories: hit.categories,
+                matched_context: hit.context,
+                match_start,
+                match_end,
+                match_prefix_sha256,
+                keyword_set_hash: plan.keyword_set_hash,
+                endpoint: request.endpoint.to_string(),
+                model: request.model.to_string(),
+                client_ip: request.client_ip.to_string(),
+                request_headers_json: redacted_headers_json(request.headers),
+                request_body_json: moderation_body_text(request.body),
+                banned_at_ms: now_ms(),
+            });
+            ModerationDecision::Block
+        },
+        ModerationPrecheck::Skip => ModerationDecision::Allow,
+    }
+}
+
+/// Compose the runtime ban key.
+pub(crate) fn moderation_session_key(provider: &str, key_id: &str, session_id: &str) -> String {
+    format!("{provider}:{key_id}:{session_id}")
+}
+
+pub(crate) fn moderation_keyword_set_hash(keywords: &[ModerationKeyword]) -> String {
+    let mut normalized: Vec<&str> = keywords
+        .iter()
+        .map(|keyword| keyword.keyword.as_str())
+        .collect();
+    normalized.sort_unstable();
+    let mut hasher = Sha256::new();
+    for keyword in normalized {
+        hasher.update(keyword.as_bytes());
+        hasher.update([0]);
+    }
+    finish_sha256_hex(hasher)
+}
+
+pub(crate) fn moderation_match_prefix_sha256(normalized_text: &str, match_start: usize) -> String {
+    let end = match_start.min(normalized_text.len());
+    let mut hasher = Sha256::new();
+    hasher.update(&normalized_text.as_bytes()[..end]);
+    finish_sha256_hex(hasher)
+}
+
+pub(crate) fn moderation_hit_key(
+    session_key: &str,
+    normalized_text: &str,
+    hit: &ModerationMatch,
+) -> String {
+    moderation_hit_key_parts(
+        session_key,
+        normalized_text,
+        &hit.keyword,
+        hit.match_start,
+        hit.match_end,
+    )
+}
+
+/// Stable identity of one keyword hit: which session, which keyword, where, and
+/// the hash of the preceding content — so the same reviewed hit stays
+/// suppressed only while its preceding context is byte-identical, and distinct
+/// keywords at the same offset get distinct keys.
+pub(crate) fn moderation_hit_key_parts(
+    session_key: &str,
+    normalized_text: &str,
+    keyword: &str,
+    match_start: usize,
+    match_end: usize,
+) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(session_key.as_bytes());
+    hasher.update([0]);
+    hasher.update(keyword.as_bytes());
+    hasher.update([0]);
+    hasher.update(match_start.to_string().as_bytes());
+    hasher.update([0]);
+    hasher.update(match_end.to_string().as_bytes());
+    hasher.update([0]);
+    hasher.update(moderation_match_prefix_sha256(normalized_text, match_start).as_bytes());
+    finish_sha256_hex(hasher)
+}
+
+/// Derive a stable content-scoped ban key for requests without any session id
+/// so identical retries are deduplicated in memory and by the store conflict.
+pub(crate) fn derived_moderation_session_key(provider: &str, key_id: &str, body: &[u8]) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(body);
+    let digest = hasher.finalize();
+    let mut preview = String::with_capacity(16);
+    for byte in digest.iter().take(8) {
+        preview.push_str(&format!("{byte:02x}"));
+    }
+    format!("{provider}:{key_id}:content:{preview}")
+}
+
+fn finish_sha256_hex(hasher: Sha256) -> String {
+    let digest = hasher.finalize();
+    let mut out = String::with_capacity(digest.len() * 2);
+    for byte in digest {
+        write!(&mut out, "{byte:02x}").expect("write to string");
+    }
+    out
+}
+
+/// Serialize request headers to a JSON object with sensitive values redacted.
+pub(crate) fn redacted_headers_json(headers: &HeaderMap) -> String {
+    let mut map = serde_json::Map::new();
+    for name in headers.keys() {
+        let key = name.as_str().to_ascii_lowercase();
+        let values: Vec<serde_json::Value> = headers
+            .get_all(name)
+            .iter()
+            .map(|value| {
+                if REDACTED_HEADER_NAMES.contains(&key.as_str()) {
+                    serde_json::Value::String("<redacted>".to_string())
+                } else {
+                    serde_json::Value::String(value.to_str().unwrap_or("<non-utf8>").to_string())
+                }
+            })
+            .collect();
+        match values.len() {
+            0 => {},
+            1 => {
+                map.insert(key, values.into_iter().next().expect("one header value"));
+            },
+            _ => {
+                map.insert(key, serde_json::Value::Array(values));
+            },
+        }
+    }
+    serde_json::to_string(&serde_json::Value::Object(map)).unwrap_or_else(|_| "{}".to_string())
+}
+
+/// Capture the request body verbatim for review. The column is `TEXT`, so the
+/// exact wire bytes are preserved (invalid UTF-8 is lossily replaced) rather
+/// than reparsed and re-serialized through JSONB.
+pub(crate) fn moderation_body_text(body: &[u8]) -> String {
+    String::from_utf8_lossy(body).into_owned()
+}
+
+/// Normalized moderation text for a parsed Anthropic messages request.
+pub(crate) fn moderation_text_for_kiro(payload: &MessagesRequest) -> String {
+    let mut collected = String::new();
+    if let Some(system) = &payload.system {
+        for block in system {
+            if !block.text.is_empty() {
+                if !collected.is_empty() {
+                    collected.push('\n');
+                }
+                collected.push_str(&block.text);
+            }
+        }
+    }
+    for message in &payload.messages {
+        match &message.content {
+            serde_json::Value::String(text) => {
+                if !text.is_empty() {
+                    if !collected.is_empty() {
+                        collected.push('\n');
+                    }
+                    collected.push_str(text);
+                }
+            },
+            other => {
+                let extracted = extract_moderation_text(other);
+                if !extracted.is_empty() {
+                    if !collected.is_empty() {
+                        collected.push('\n');
+                    }
+                    collected.push_str(&extracted);
+                }
+            },
+        }
+    }
+    normalize_moderation_text(&collected)
+}
+
+/// Normalized moderation text for a raw JSON request body (Codex surface).
+pub(crate) fn moderation_text_for_json_body(body: &[u8]) -> Option<String> {
+    let value = serde_json::from_slice::<serde_json::Value>(body).ok()?;
+    Some(normalize_moderation_text(&extract_moderation_text(&value)))
+}
+
+fn moderation_refresh_interval() -> Duration {
+    std::env::var(MODERATION_REFRESH_INTERVAL_ENV)
+        .ok()
+        .and_then(|value| value.trim().parse::<u64>().ok())
+        .map(|seconds| Duration::from_secs(seconds.clamp(15, 24 * 60 * 60)))
+        .unwrap_or(DEFAULT_MODERATION_REFRESH_INTERVAL)
+}
+
+fn now_ms() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|duration| duration.as_millis().min(i64::MAX as u128) as i64)
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Mutex;
+
+    use async_trait::async_trait;
+    use axum::http::{HeaderMap, HeaderValue};
+    use llm_access_core::store::{
+        AdminPageRequest, ModerationBannedSession, ModerationBannedSessionDetail,
+        ModerationBannedSessionsPage, ModerationCategory, ModerationKeyword,
+        ModerationKeywordImportOutcome, ModerationRuntimeSnapshot, ModerationSuppressedHit,
+        NewModerationCategory, NewModerationKeyword,
+    };
+    use serde_json::json;
+
+    use super::*;
+
+    #[derive(Default)]
+    struct MemoryModerationStore {
+        snapshot: Mutex<ModerationRuntimeSnapshot>,
+        records: Mutex<Vec<NewModerationBannedSession>>,
+    }
+
+    impl MemoryModerationStore {
+        fn with_snapshot(snapshot: ModerationRuntimeSnapshot) -> Self {
+            Self {
+                snapshot: Mutex::new(snapshot),
+                records: Mutex::new(Vec::new()),
+            }
+        }
+
+        fn records(&self) -> Vec<NewModerationBannedSession> {
+            self.records.lock().expect("records lock").clone()
+        }
+    }
+
+    #[async_trait]
+    impl AdminModerationStore for MemoryModerationStore {
+        async fn load_moderation_runtime_snapshot(
+            &self,
+        ) -> anyhow::Result<ModerationRuntimeSnapshot> {
+            Ok(self.snapshot.lock().expect("snapshot lock").clone())
+        }
+
+        async fn list_moderation_categories(&self) -> anyhow::Result<Vec<ModerationCategory>> {
+            Ok(Vec::new())
+        }
+
+        async fn add_moderation_categories(
+            &self,
+            _categories: Vec<NewModerationCategory>,
+        ) -> anyhow::Result<usize> {
+            Ok(0)
+        }
+
+        async fn delete_moderation_category(
+            &self,
+            _code: &str,
+        ) -> anyhow::Result<Option<ModerationCategory>> {
+            Ok(None)
+        }
+
+        async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>> {
+            Ok(self
+                .snapshot
+                .lock()
+                .expect("snapshot lock")
+                .keywords
+                .clone())
+        }
+
+        async fn add_moderation_keywords(
+            &self,
+            _keywords: Vec<NewModerationKeyword>,
+        ) -> anyhow::Result<ModerationKeywordImportOutcome> {
+            Ok(ModerationKeywordImportOutcome::default())
+        }
+
+        async fn delete_moderation_keyword(
+            &self,
+            _id: i64,
+        ) -> anyhow::Result<Option<ModerationKeyword>> {
+            Ok(None)
+        }
+
+        async fn record_moderation_banned_session(
+            &self,
+            record: NewModerationBannedSession,
+        ) -> anyhow::Result<bool> {
+            let mut records = self.records.lock().expect("records lock");
+            if records
+                .iter()
+                .any(|existing| existing.hit_key == record.hit_key)
+            {
+                return Ok(false);
+            }
+            records.push(record);
+            Ok(true)
+        }
+
+        async fn list_moderation_banned_sessions(
+            &self,
+            page: AdminPageRequest,
+            _status: Option<&str>,
+        ) -> anyhow::Result<ModerationBannedSessionsPage> {
+            Ok(ModerationBannedSessionsPage {
+                sessions: Vec::new(),
+                total: 0,
+                limit: page.limit,
+                offset: page.offset,
+                has_more: false,
+            })
+        }
+
+        async fn get_moderation_banned_session(
+            &self,
+            _id: i64,
+        ) -> anyhow::Result<Option<ModerationBannedSessionDetail>> {
+            Ok(None)
+        }
+
+        async fn set_moderation_banned_session_status(
+            &self,
+            _id: i64,
+            _status: &str,
+            _review_note: Option<&str>,
+            _reviewed_at_ms: i64,
+        ) -> anyhow::Result<Option<ModerationBannedSession>> {
+            Ok(None)
+        }
+    }
+
+    fn moderation_keyword(id: i64, keyword: &str) -> ModerationKeyword {
+        ModerationKeyword {
+            id,
+            keyword: keyword.to_string(),
+            categories: Vec::new(),
+            note: None,
+            source: "txt".to_string(),
+            created_at_ms: 1,
+        }
+    }
+
+    fn sample_key() -> AuthenticatedKey {
+        AuthenticatedKey {
+            key_id: "key-1".to_string(),
+            key_name: "external".to_string(),
+            provider_type: "kiro".to_string(),
+            protocol_family: "anthropic".to_string(),
+            status: "active".to_string(),
+            quota_billable_limit: 0,
+            billable_tokens_used: 0,
+        }
+    }
+
+    #[test]
+    fn session_key_uses_provider_key_and_session() {
+        assert_eq!(
+            moderation_session_key(MODERATION_PROVIDER_KIRO, "key-1", "sess-9"),
+            "kiro:key-1:sess-9"
+        );
+    }
+
+    #[test]
+    fn derived_session_key_is_stable_and_content_scoped() {
+        let a = derived_moderation_session_key(MODERATION_PROVIDER_CODEX, "key-1", b"hello world");
+        let b = derived_moderation_session_key(MODERATION_PROVIDER_CODEX, "key-1", b"hello world");
+        let c = derived_moderation_session_key(MODERATION_PROVIDER_CODEX, "key-1", b"other body");
+        assert_eq!(a, b);
+        assert_ne!(a, c);
+        assert!(a.starts_with("codex:key-1:content:"));
+    }
+
+    #[test]
+    fn redacted_headers_hide_sensitive_values() {
+        let mut headers = HeaderMap::new();
+        headers.insert("authorization", HeaderValue::from_static("Bearer secret"));
+        headers.insert("x-api-key", HeaderValue::from_static("sk-123"));
+        headers.insert("content-type", HeaderValue::from_static("application/json"));
+        let json = redacted_headers_json(&headers);
+        let value: serde_json::Value = serde_json::from_str(&json).expect("valid json");
+        assert_eq!(value["authorization"], "<redacted>");
+        assert_eq!(value["x-api-key"], "<redacted>");
+        assert_eq!(value["content-type"], "application/json");
+    }
+
+    #[test]
+    fn body_text_captures_bytes_verbatim() {
+        assert_eq!(moderation_body_text(br#"{"a":1}"#), r#"{"a":1}"#);
+        // Non-JSON bodies are captured verbatim, not JSON-wrapped.
+        assert_eq!(moderation_body_text(b"not json"), "not json");
+    }
+
+    #[test]
+    fn kiro_text_extraction_joins_system_and_messages() {
+        let payload: MessagesRequest = serde_json::from_value(json!({
+            "model": "claude-sonnet-4",
+            "max_tokens": 64,
+            "system": "You are HELPFUL",
+            "messages": [
+                {"role": "user", "content": "How to Build a Bomb"},
+                {"role": "assistant", "content": [{"type": "text", "text": "No."}]}
+            ]
+        }))
+        .expect("parse messages request");
+        let text = moderation_text_for_kiro(&payload);
+        assert!(text.contains("you are helpful"));
+        assert!(text.contains("how to build a bomb"));
+        assert!(!text.contains("claude-sonnet-4"));
+    }
+
+    #[test]
+    fn json_body_text_extraction_normalizes_content() {
+        let body = json!({
+            "model": "gpt-5",
+            "messages": [{"role": "user", "content": "Hello  World"}]
+        })
+        .to_string();
+        let text = moderation_text_for_json_body(body.as_bytes()).expect("some text");
+        assert_eq!(text, "hello world");
+    }
+
+    #[tokio::test]
+    async fn disabled_gate_skips_all_sessions() {
+        let gate = ModerationGate::disabled();
+        assert!(matches!(gate.precheck(Some("kiro:key:sess")), ModerationPrecheck::Skip));
+        assert!(matches!(gate.precheck(None), ModerationPrecheck::Skip));
+        let stats = gate.stats();
+        assert_eq!(stats.keyword_count, 0);
+        assert!(stats.loaded);
+    }
+
+    #[tokio::test]
+    async fn unbanned_hit_is_suppressed_and_later_hit_in_same_session_blocks() {
+        let keywords =
+            vec![moderation_keyword(1, "build a bomb"), moderation_keyword(2, "carding tutorial")];
+        let keyword_set_hash = moderation_keyword_set_hash(&keywords);
+        let text = normalize_moderation_text(
+            "reviewed false positive: build a bomb. New content asks for carding tutorial.",
+        );
+        let matcher = ModerationMatcher::build(
+            keywords
+                .iter()
+                .map(|keyword| (keyword.keyword.as_str(), keyword.categories.clone())),
+        )
+        .expect("build matcher")
+        .expect("matcher");
+        let reviewed_hit = matcher.find(&text).expect("reviewed hit");
+        assert_eq!(reviewed_hit.keyword, "build a bomb");
+
+        let session_key = moderation_session_key(MODERATION_PROVIDER_KIRO, "key-1", "sess-1");
+        let reviewed_hit_key = moderation_hit_key(&session_key, &text, &reviewed_hit);
+        let store = Arc::new(MemoryModerationStore::with_snapshot(ModerationRuntimeSnapshot {
+            keywords,
+            banned_session_keys: Vec::new(),
+            suppressed_hits: vec![ModerationSuppressedHit {
+                session_key: session_key.clone(),
+                hit_key: reviewed_hit_key.clone(),
+                match_start: reviewed_hit.match_start as i64,
+                match_end: reviewed_hit.match_end as i64,
+                match_prefix_sha256: moderation_match_prefix_sha256(
+                    &text,
+                    reviewed_hit.match_start,
+                ),
+                keyword_set_hash,
+            }],
+        }));
+        let gate = ModerationGate::new(store.clone());
+        gate.reload().await.expect("load moderation snapshot");
+
+        let headers = HeaderMap::new();
+        let key = sample_key();
+        let decision = enforce_moderation(
+            &gate,
+            ModerationRequest {
+                provider: MODERATION_PROVIDER_KIRO,
+                key: &key,
+                session_id: Some("sess-1"),
+                endpoint: "/v1/messages",
+                model: "claude-sonnet-4",
+                headers: &headers,
+                body: b"{}",
+                client_ip: "127.0.0.1",
+            },
+            || text.clone(),
+        );
+        assert!(matches!(decision, ModerationDecision::Block));
+
+        for _ in 0..20 {
+            if !store.records().is_empty() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        let records = store.records();
+        assert_eq!(records.len(), 1);
+        assert_eq!(records[0].session_key, session_key);
+        assert_eq!(records[0].matched_keyword, "carding tutorial");
+        assert_ne!(records[0].hit_key, reviewed_hit_key);
+        assert!(records[0].match_start > reviewed_hit.match_start as i64);
+    }
+
+    #[tokio::test]
+    async fn changed_keyword_at_reviewed_position_is_not_suppressed() {
+        let keywords =
+            vec![moderation_keyword(1, "build a bomb"), moderation_keyword(2, "carding tutorial")];
+        let keyword_set_hash = moderation_keyword_set_hash(&keywords);
+        let reviewed_text = normalize_moderation_text("reviewed false positive: build a bomb");
+        let changed_text = normalize_moderation_text("reviewed false positive: carding tutorial");
+        let matcher = ModerationMatcher::build(
+            keywords
+                .iter()
+                .map(|keyword| (keyword.keyword.as_str(), keyword.categories.clone())),
+        )
+        .expect("build matcher")
+        .expect("matcher");
+        let reviewed_hit = matcher.find(&reviewed_text).expect("reviewed hit");
+        assert_eq!(reviewed_hit.keyword, "build a bomb");
+
+        let session_key = moderation_session_key(MODERATION_PROVIDER_KIRO, "key-1", "sess-1");
+        let reviewed_hit_key = moderation_hit_key(&session_key, &reviewed_text, &reviewed_hit);
+        let store = Arc::new(MemoryModerationStore::with_snapshot(ModerationRuntimeSnapshot {
+            keywords,
+            banned_session_keys: Vec::new(),
+            suppressed_hits: vec![ModerationSuppressedHit {
+                session_key: session_key.clone(),
+                hit_key: reviewed_hit_key,
+                match_start: reviewed_hit.match_start as i64,
+                match_end: reviewed_hit.match_end as i64,
+                match_prefix_sha256: moderation_match_prefix_sha256(
+                    &reviewed_text,
+                    reviewed_hit.match_start,
+                ),
+                keyword_set_hash,
+            }],
+        }));
+        let gate = ModerationGate::new(store.clone());
+        gate.reload().await.expect("load moderation snapshot");
+
+        let headers = HeaderMap::new();
+        let key = sample_key();
+        let decision = enforce_moderation(
+            &gate,
+            ModerationRequest {
+                provider: MODERATION_PROVIDER_KIRO,
+                key: &key,
+                session_id: Some("sess-1"),
+                endpoint: "/v1/messages",
+                model: "claude-sonnet-4",
+                headers: &headers,
+                body: b"{}",
+                client_ip: "127.0.0.1",
+            },
+            || changed_text.clone(),
+        );
+        assert!(matches!(decision, ModerationDecision::Block));
+
+        for _ in 0..20 {
+            if !store.records().is_empty() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        let records = store.records();
+        assert_eq!(records.len(), 1);
+        assert_eq!(records[0].matched_keyword, "carding tutorial");
+        assert_eq!(records[0].match_start, reviewed_hit.match_start as i64);
+    }
+
+    #[tokio::test]
+    async fn co_located_keyword_still_blocks_after_sibling_unbanned() {
+        // "bomb" and "bomb making" hit the SAME start offset. Unbanning the
+        // shorter one must not mask the distinct longer one (regression for the
+        // suppression-advance-by-offset bypass).
+        let keywords = vec![moderation_keyword(1, "bomb"), moderation_keyword(2, "bomb making")];
+        let keyword_set_hash = moderation_keyword_set_hash(&keywords);
+        let text = normalize_moderation_text("here is bomb making guide");
+        let matcher = ModerationMatcher::build(
+            keywords
+                .iter()
+                .map(|keyword| (keyword.keyword.as_str(), keyword.categories.clone())),
+        )
+        .expect("build matcher")
+        .expect("matcher");
+        // find() returns the shortest-end hit first: "bomb". Suppress exactly it.
+        let bomb_hit = matcher.find(&text).expect("bomb hit");
+        assert_eq!(bomb_hit.keyword, "bomb");
+
+        let session_key = moderation_session_key(MODERATION_PROVIDER_KIRO, "key-1", "sess-1");
+        let bomb_hit_key = moderation_hit_key(&session_key, &text, &bomb_hit);
+        let store = Arc::new(MemoryModerationStore::with_snapshot(ModerationRuntimeSnapshot {
+            keywords,
+            banned_session_keys: Vec::new(),
+            suppressed_hits: vec![ModerationSuppressedHit {
+                session_key: session_key.clone(),
+                hit_key: bomb_hit_key.clone(),
+                match_start: bomb_hit.match_start as i64,
+                match_end: bomb_hit.match_end as i64,
+                match_prefix_sha256: moderation_match_prefix_sha256(&text, bomb_hit.match_start),
+                keyword_set_hash,
+            }],
+        }));
+        let gate = ModerationGate::new(store.clone());
+        gate.reload().await.expect("load moderation snapshot");
+
+        let headers = HeaderMap::new();
+        let key = sample_key();
+        let decision = enforce_moderation(
+            &gate,
+            ModerationRequest {
+                provider: MODERATION_PROVIDER_KIRO,
+                key: &key,
+                session_id: Some("sess-1"),
+                endpoint: "/v1/messages",
+                model: "claude-sonnet-4",
+                headers: &headers,
+                body: b"{}",
+                client_ip: "127.0.0.1",
+            },
+            || text.clone(),
+        );
+        assert!(matches!(decision, ModerationDecision::Block));
+
+        for _ in 0..20 {
+            if !store.records().is_empty() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        let records = store.records();
+        assert_eq!(records.len(), 1);
+        // The distinct co-located keyword must be the one that blocks.
+        assert_eq!(records[0].matched_keyword, "bomb making");
+        assert_eq!(records[0].match_start, bomb_hit.match_start as i64);
+        assert_ne!(records[0].hit_key, bomb_hit_key);
+    }
+}
diff --git a/crates/llm-access/src/provider.rs b/crates/llm-access/src/provider.rs
index 971027b9..24589244 100644
--- a/crates/llm-access/src/provider.rs
+++ b/crates/llm-access/src/provider.rs
@@ -207,6 +207,7 @@ pub struct ProviderState {
     kiro_latency_ranker: Arc<KiroLatencyRanker>,
     request_activity: Arc<RequestActivityTracker>,
     protected_thinking_signature_secret: Option<Arc<str>>,
+    moderation_gate: Arc<crate::moderation::ModerationGate>,
 }
 
 /// Runtime dependencies passed from the authenticated provider entrypoint into
@@ -227,6 +228,7 @@ pub struct ProviderDispatchDeps {
     kiro_session_affinity: Arc<KiroSessionAffinity>,
     kiro_latency_ranker: Arc<KiroLatencyRanker>,
     protected_thinking_signature_secret: Option<Arc<str>>,
+    moderation_gate: Arc<crate::moderation::ModerationGate>,
 }
 
 struct ForcedProxyRouteStore {
diff --git a/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs b/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
index e68f518a..808bb028 100644
--- a/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
+++ b/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
@@ -18,6 +18,7 @@ use llm_access_anthropic_pool::{
     apply_anthropic_auth_headers, build_messages_url, merge_usage, parse_usage_from_value,
     AnthropicUsageSummary, SmoothWeightedRoundRobin, WeightedChannel, ANTHROPIC_VERSION_2023_06_01,
 };
+use llm_access_codex::request::extract_client_ip_from_headers;
 use llm_access_core::{
     provider::{ProtocolFamily, ProviderType},
     store::{
@@ -37,6 +38,7 @@ use super::{
     },
     client::anthropic_upstream_client,
     kiro_error::kiro_json_error,
+    kiro_model::{kiro_affinity_session_id, resolve_kiro_request_session},
     kiro_protocol::normalized_kiro_messages_path,
     limiter::{kiro_key_limit_response, try_acquire_key_permit},
     usage_meta::{
@@ -46,6 +48,10 @@ use super::{
     util::{clamp_duration_ms, clamp_u64_to_i64, now_millis},
     ProviderDispatchDeps, ProviderUsageMetadata, MAX_PROVIDER_PROXY_BODY_BYTES,
 };
+use crate::moderation::{
+    enforce_moderation, moderation_text_for_kiro, ModerationDecision, ModerationRequest,
+    MODERATION_BLOCKED_MESSAGE, MODERATION_PROVIDER_KIRO,
+};
 
 static DIRECT_ANTHROPIC_SCHEDULER: LazyLock<Mutex<SmoothWeightedRoundRobin>> =
     LazyLock::new(|| Mutex::new(SmoothWeightedRoundRobin::default()));
@@ -208,6 +214,17 @@ pub(super) async fn maybe_dispatch_anthropic_upstream_pool(
         original_model,
         preflight,
     } = prepared;
+    if let Some(response) = enforce_direct_anthropic_moderation(
+        &key,
+        public_path,
+        &original_model,
+        &replay.headers,
+        &replay.body,
+        &preflight.request,
+        &deps,
+    ) {
+        return AnthropicUpstreamDispatchOutcome::Handled(response);
+    }
     let preflight_stats = direct_anthropic_preflight_stats(&preflight);
     if preflight_stats.normalized() {
         tracing::info!(
@@ -259,6 +276,48 @@ pub(super) async fn maybe_dispatch_anthropic_upstream_pool(
     }
 }
 
+/// Enforce the keyword moderation gate on the direct Anthropic upstream path.
+///
+/// The Anthropic-upstream pool short-circuits `dispatch_kiro_proxy` before its
+/// own moderation check runs, so this path re-applies the same gate through the
+/// shared [`enforce_moderation`] flow (see `crate::moderation`). Returns a
+/// rejection response when the session is banned or a keyword fires, else
+/// `None` to continue to upstream dispatch.
+fn enforce_direct_anthropic_moderation(
+    key: &AuthenticatedKey,
+    endpoint: &str,
+    model: &str,
+    request_headers: &HeaderMap,
+    body: &Bytes,
+    payload: &llm_access_kiro::anthropic::types::MessagesRequest,
+    deps: &ProviderDispatchDeps,
+) -> Option<axum::response::Response> {
+    let resolved_session = resolve_kiro_request_session(request_headers, payload.metadata.as_ref());
+    let affinity_session_id = kiro_affinity_session_id(&resolved_session);
+    let client_ip = extract_client_ip_from_headers(request_headers);
+    match enforce_moderation(
+        &deps.moderation_gate,
+        ModerationRequest {
+            provider: MODERATION_PROVIDER_KIRO,
+            key,
+            session_id: affinity_session_id,
+            endpoint,
+            model,
+            headers: request_headers,
+            body,
+            client_ip: &client_ip,
+        },
+        || moderation_text_for_kiro(payload),
+    ) {
+        ModerationDecision::Block => Some(kiro_json_error(
+            StatusCode::FORBIDDEN,
+            "permission_error",
+            MODERATION_BLOCKED_MESSAGE,
+        )),
+        ModerationDecision::Allow => None,
+    }
+}
+
 fn order_routes_for_request(
     mut routes: Vec<ProviderAnthropicUpstreamRoute>,
 ) -> Vec<ProviderAnthropicUpstreamRoute> {
diff --git a/crates/llm-access/src/provider/codex_dispatch.rs b/crates/llm-access/src/provider/codex_dispatch.rs
index 617eee84..0fc24c26 100644
--- a/crates/llm-access/src/provider/codex_dispatch.rs
+++ b/crates/llm-access/src/provider/codex_dispatch.rs
@@ -79,7 +79,13 @@ use super::{
     StreamRecordState, CODEX_TRANSIENT_ACCOUNT_FAILURE_COOLDOWN_MAX,
     CODEX_TRANSIENT_ACCOUNT_FAILURE_COOLDOWN_MIN, MAX_PROVIDER_PROXY_BODY_BYTES,
 };
-use crate::codex_refresh;
+use crate::{
+    codex_refresh,
+    moderation::{
+        enforce_moderation, moderation_text_for_json_body, ModerationDecision, ModerationRequest,
+        MODERATION_BLOCKED_MESSAGE, MODERATION_PROVIDER_CODEX,
+    },
+};
 
 pub async fn dispatch_codex_proxy(
     key: AuthenticatedKey,
@@ -96,6 +102,7 @@ pub async fn dispatch_codex_proxy(
         codex_session_affinity,
         codex_session_recovery,
         codex_session_rejection,
+        moderation_gate,
         ..
     } = deps;
     let mut usage_meta = ProviderUsageMetadata::from_request_parts(
@@ -242,6 +249,39 @@ pub async fn dispatch_codex_proxy(
         prepared.resolved_session_id.as_deref(),
         prepared.resolved_session_source,
     );
+    let codex_model = prepared
+        .client_visible_model
+        .clone()
+        .or_else(|| prepared.model.clone())
+        .unwrap_or_default();
+    let codex_session_id = prepared
+        .resolved_session_id
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty());
+    // Keyword moderation gate: reject (and, on a fresh keyword hit, capture and
+    // ban the session) before any upstream work. See `crate::moderation`.
+    if let ModerationDecision::Block = enforce_moderation(
+        &moderation_gate,
+        ModerationRequest {
+            provider: MODERATION_PROVIDER_CODEX,
+            key: &key,
+            session_id: codex_session_id,
+            endpoint: &gateway_path,
+            model: &codex_model,
+            headers: &request_headers,
+            body: &body,
+            client_ip: &usage_meta.client_ip,
+        },
+        || moderation_text_for_json_body(&body).unwrap_or_default(),
+    ) {
+        usage_meta.mark_session_blocked();
+        return codex_surface_error_response(
+            &gateway_path,
+            StatusCode::FORBIDDEN,
+            MODERATION_BLOCKED_MESSAGE,
+        );
+    }
     if strict_session_rejection_enabled {
         if let Some((affinity_id, rejection)) = codex_affinity_id.as_ref().and_then(|id| {
             codex_session_rejection
diff --git a/crates/llm-access/src/provider/kiro_dispatch.rs b/crates/llm-access/src/provider/kiro_dispatch.rs
index 333dcaed..6b9607da 100644
--- a/crates/llm-access/src/provider/kiro_dispatch.rs
+++ b/crates/llm-access/src/provider/kiro_dispatch.rs
@@ -82,7 +82,13 @@ use super::{
     KiroWebsearchUsageRecord, ProviderDispatchDeps, ProviderUsageMetadata, WebsearchResponseInput,
     KIRO_EMPTY_STREAM_MAX_RETRIES, MAX_PROVIDER_PROXY_BODY_BYTES,
 };
-use crate::kiro_refresh;
+use crate::{
+    kiro_refresh,
+    moderation::{
+        enforce_moderation, moderation_text_for_kiro, ModerationDecision, ModerationRequest,
+        MODERATION_BLOCKED_MESSAGE, MODERATION_PROVIDER_KIRO,
+    },
+};
 
 const INCONSISTENT_ROUTE_CONFIGURATION_MESSAGE: &str = "Route configuration is inconsistent.";
 const KIRO_SAME_ACCOUNT_MAX_ATTEMPTS: usize = 3;
@@ -182,6 +188,7 @@ pub async fn dispatch_kiro_proxy(
         kiro_session_affinity,
         kiro_latency_ranker,
         protected_thinking_signature_secret,
+        moderation_gate,
         ..
     } = deps;
     let mut usage_meta = ProviderUsageMetadata::from_request_parts(
@@ -317,6 +324,30 @@ pub async fn dispatch_kiro_proxy(
     let resolved_session =
         resolve_kiro_request_session(&request_headers, payload.metadata.as_ref());
     let affinity_session_id = kiro_affinity_session_id(&resolved_session).map(str::to_string);
+    // Keyword moderation gate: reject the request (and, on a fresh keyword hit,
+    // capture and ban the session) before any upstream work. The gate is
+    // dormant-cheap and reads only in-memory state; see `crate::moderation` for
+    // the full decision flow.
+    if let ModerationDecision::Block = enforce_moderation(
+        &moderation_gate,
+        ModerationRequest {
+            provider: MODERATION_PROVIDER_KIRO,
+            key: &key,
+            session_id: affinity_session_id.as_deref(),
+            endpoint: public_path,
+            model: &effective_model,
+            headers: &request_headers,
+            body: &body,
+            client_ip: &usage_meta.client_ip,
+        },
+        || moderation_text_for_kiro(&payload),
+    ) {
+        return kiro_json_error(
+            StatusCode::FORBIDDEN,
+            "permission_error",
+            MODERATION_BLOCKED_MESSAGE,
+        );
+    }
     if routes[0].remote_media_resolution_enabled {
         if let Err(err) = resolve_kiro_remote_media_sources(&mut payload).await {
             let message = err.to_string();
diff --git a/crates/llm-access/src/provider/state.rs b/crates/llm-access/src/provider/state.rs
index 1aa30cdb..76cbb9c8 100644
--- a/crates/llm-access/src/provider/state.rs
+++ b/crates/llm-access/src/provider/state.rs
@@ -30,6 +30,7 @@ use super::{
 };
 use crate::{
     activity::RequestActivityTracker, geoip::GeoIpResolver, kiro_latency::KiroLatencyRanker,
+    moderation::ModerationGate,
 };
 
 fn protected_thinking_signature_secret_from_env() -> Option<Arc<str>> {
@@ -144,9 +145,15 @@ impl ProviderState {
             kiro_latency_ranker,
             request_activity,
             protected_thinking_signature_secret: protected_thinking_signature_secret_from_env(),
+            moderation_gate: ModerationGate::disabled(),
         }
     }
 
+    /// Install the shared keyword moderation gate used by provider dispatch.
+    pub fn set_moderation_gate(&mut self, moderation_gate: Arc<ModerationGate>) {
+        self.moderation_gate = moderation_gate;
+    }
+
     pub(crate) fn route_store(&self) -> Arc<dyn ProviderRouteStore> {
         Arc::clone(&self.route_store)
     }
@@ -214,6 +221,7 @@ impl ProviderState {
             kiro_session_affinity: Arc::clone(&self.kiro_session_affinity),
             kiro_latency_ranker: Arc::clone(&self.kiro_latency_ranker),
             protected_thinking_signature_secret: self.protected_thinking_signature_secret.clone(),
+            moderation_gate: Arc::clone(&self.moderation_gate),
         }
     }
 }
diff --git a/crates/llm-access/src/runtime.rs b/crates/llm-access/src/runtime.rs
index b49a28db..8ca6f858 100644
--- a/crates/llm-access/src/runtime.rs
+++ b/crates/llm-access/src/runtime.rs
@@ -12,13 +12,15 @@ use anyhow::{anyhow, Context};
 use async_trait::async_trait;
 use llm_access_core::store::{
     AdminAccountGroupStore, AdminAnthropicUpstreamStore, AdminCodexAccountStore, AdminConfigStore,
-    AdminKeyStore, AdminKiroAccountStore, AdminProxyStore, AdminReviewQueueStore, ControlStore,
-    EmptyAdminAccountGroupStore, EmptyAdminAnthropicUpstreamStore, EmptyAdminCodexAccountStore,
-    EmptyAdminConfigStore, EmptyAdminKeyStore, EmptyAdminKiroAccountStore, EmptyAdminProxyStore,
-    EmptyAdminReviewQueueStore, EmptyProviderRouteStore, EmptyPublicAccessStore,
-    EmptyPublicCommunityStore, EmptyPublicStatusStore, EmptyPublicSubmissionStore,
-    EmptyPublicUsageStore, ProviderRouteStore, PublicAccessStore, PublicCommunityStore,
-    PublicStatusStore, PublicSubmissionStore, PublicUsageStore, DEFAULT_CODEX_CLIENT_VERSION,
+    AdminKeyStore, AdminKiroAccountStore, AdminModerationStore, AdminProxyStore,
+    AdminReviewQueueStore, ControlStore, EmptyAdminAccountGroupStore,
+    EmptyAdminAnthropicUpstreamStore, EmptyAdminCodexAccountStore, EmptyAdminConfigStore,
+    EmptyAdminKeyStore, EmptyAdminKiroAccountStore, EmptyAdminModerationStore,
+    EmptyAdminProxyStore, EmptyAdminReviewQueueStore, EmptyProviderRouteStore,
+    EmptyPublicAccessStore, EmptyPublicCommunityStore, EmptyPublicStatusStore,
+    EmptyPublicSubmissionStore, EmptyPublicUsageStore, ProviderRouteStore, PublicAccessStore,
+    PublicCommunityStore, PublicStatusStore, PublicSubmissionStore, PublicUsageStore,
+    DEFAULT_CODEX_CLIENT_VERSION,
 };
 #[cfg(any(feature = "duckdb-runtime", feature = "duckdb-bundled"))]
 use llm_access_core::store::{
@@ -73,6 +75,7 @@ pub struct LlmAccessRuntime {
     admin_codex_account_store: Arc<dyn AdminCodexAccountStore>,
     admin_kiro_account_store: Arc<dyn AdminKiroAccountStore>,
     admin_anthropic_upstream_store: Arc<dyn AdminAnthropicUpstreamStore>,
+    admin_moderation_store: Arc<dyn AdminModerationStore>,
     admin_review_queue_store: Arc<dyn AdminReviewQueueStore>,
     public_access_store: Arc<dyn PublicAccessStore>,
     public_community_store: Arc<dyn PublicCommunityStore>,
@@ -104,6 +107,7 @@ struct LlmAccessStores {
     admin_codex_account_store: Arc<dyn AdminCodexAccountStore>,
     admin_kiro_account_store: Arc<dyn AdminKiroAccountStore>,
     admin_anthropic_upstream_store: Arc<dyn AdminAnthropicUpstreamStore>,
+    admin_moderation_store: Arc<dyn AdminModerationStore>,
     admin_review_queue_store: Arc<dyn AdminReviewQueueStore>,
     public_access_store: Arc<dyn PublicAccessStore>,
     public_community_store: Arc<dyn PublicCommunityStore>,
@@ -132,6 +136,7 @@ trait RuntimeRepository:
     + AdminCodexAccountStore
     + AdminKiroAccountStore
     + AdminAnthropicUpstreamStore
+    + AdminModerationStore
     + AdminReviewQueueStore
     + PublicAccessStore
     + PublicCommunityStore
@@ -155,6 +160,7 @@ impl<T> RuntimeRepository for T where
         + AdminCodexAccountStore
         + AdminKiroAccountStore
         + AdminAnthropicUpstreamStore
+        + AdminModerationStore
         + AdminReviewQueueStore
         + PublicAccessStore
         + PublicCommunityStore
@@ -178,6 +184,7 @@ trait RuntimeRepository:
     + AdminCodexAccountStore
     + AdminKiroAccountStore
     + AdminAnthropicUpstreamStore
+    + AdminModerationStore
     + AdminReviewQueueStore
     + PublicAccessStore
     + PublicCommunityStore
@@ -200,6 +207,7 @@ impl<T> RuntimeRepository for T where
         + AdminCodexAccountStore
         + AdminKiroAccountStore
         + AdminAnthropicUpstreamStore
+        + AdminModerationStore
         + AdminReviewQueueStore
         + PublicAccessStore
         + PublicCommunityStore
@@ -259,6 +267,7 @@ impl LlmAccessRuntime {
             admin_codex_account_store: Arc::new(EmptyAdminCodexAccountStore),
             admin_kiro_account_store: Arc::new(EmptyAdminKiroAccountStore),
             admin_anthropic_upstream_store: Arc::new(EmptyAdminAnthropicUpstreamStore),
+            admin_moderation_store: Arc::new(EmptyAdminModerationStore),
             admin_review_queue_store: Arc::new(EmptyAdminReviewQueueStore),
             public_access_store: Arc::new(EmptyPublicAccessStore),
             public_community_store: Arc::new(EmptyPublicCommunityStore),
@@ -293,6 +302,7 @@ impl LlmAccessRuntime {
             admin_codex_account_store: stores.admin_codex_account_store,
             admin_kiro_account_store: stores.admin_kiro_account_store,
             admin_anthropic_upstream_store: stores.admin_anthropic_upstream_store,
+            admin_moderation_store: stores.admin_moderation_store,
             admin_review_queue_store: stores.admin_review_queue_store,
             public_access_store: stores.public_access_store,
             public_community_store: stores.public_community_store,
@@ -428,6 +438,7 @@ impl LlmAccessRuntime {
         let admin_kiro_account_store: Arc<dyn AdminKiroAccountStore> = repository.clone();
         let admin_anthropic_upstream_store: Arc<dyn AdminAnthropicUpstreamStore> =
             repository.clone();
+        let admin_moderation_store: Arc<dyn AdminModerationStore> = repository.clone();
         let admin_review_queue_store: Arc<dyn AdminReviewQueueStore> = repository.clone();
         #[cfg(any(feature = "duckdb-runtime", feature = "duckdb-bundled"))]
         let public_access_store: Arc<dyn PublicAccessStore> =
@@ -460,6 +471,7 @@ impl LlmAccessRuntime {
             admin_codex_account_store,
             admin_kiro_account_store,
             admin_anthropic_upstream_store,
+            admin_moderation_store,
             admin_review_queue_store,
             public_access_store,
             public_community_store,
@@ -548,6 +560,12 @@ impl LlmAccessRuntime {
         Arc::clone(&self.admin_anthropic_upstream_store)
     }
 
+    /// Keyword moderation store used by the moderation gate and admin
+    /// endpoints.
+    pub fn admin_moderation_store(&self) -> Arc<dyn AdminModerationStore> {
+        Arc::clone(&self.admin_moderation_store)
+    }
+
     /// Admin review queue store used by local admin endpoints.
     pub fn admin_review_queue_store(&self) -> Arc<dyn AdminReviewQueueStore> {
         Arc::clone(&self.admin_review_queue_store)