From 53d689354adeebf9bb5326a4c10702fb442f62b9 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 02:44:30 +0800
Subject: [PATCH 01/11] feat(llm-access): keyword-based session moderation gate

Add a pre-upstream keyword moderation module for the Kiro and Codex
gateways. When request content matches a configured keyword the session
is banned in memory and this plus all subsequent requests are blocked;
the full request body and (redacted) headers are captured once for
admin review, and a reviewer can unban a session.

Design highlights:
- Phrase matching via Aho-Corasick over normalized text (lowercased,
  whitespace-collapsed); ASCII keywords require word boundaries while
  CJK phrases match freely. Only user-visible message content is scanned
  (system + messages[].content / instructions), not JSON structure noise.
- Keywords import from plain-text (one phrase per line) or JSON.
- Hot path never reads Postgres: the compiled automaton plus banned /
  allowlisted session-key sets live in process memory, refreshed on
  startup and a periodic interval. Already-banned sessions are rejected
  without a scan or a write; a new ban persists exactly once (JSONB body
  + headers) via a spawned task.
- Admin API + Yew review console: manage keywords and review captured
  bans (inspect payload, keep or lift the ban).

Storage: new AdminModerationStore trait, empty stub, Postgres impl, and
migration 0036 (llm_moderation_keywords, llm_moderation_banned_sessions).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 Cargo.lock                                    |   1 +
 Cargo.toml                                    |   1 +
 crates/backend/src/routes.rs                  |   2 +
 crates/frontend/src/api.rs                    | 265 ++++++++
 .../frontend/src/pages/admin_llm_gateway.rs   |   1 +
 crates/frontend/src/pages/admin_moderation.rs | 590 ++++++++++++++++++
 crates/frontend/src/pages/mod.rs              |   1 +
 crates/frontend/src/router.rs                 |  10 +
 crates/frontend/src/seo.rs                    |   2 +
 crates/llm-access-core/Cargo.toml             |   1 +
 crates/llm-access-core/src/lib.rs             |   1 +
 crates/llm-access-core/src/moderation.rs      | 416 ++++++++++++
 crates/llm-access-core/src/store/empty.rs     |  80 ++-
 crates/llm-access-core/src/store/mod.rs       |  25 +-
 .../llm-access-core/src/store/moderation.rs   | 156 +++++
 crates/llm-access-core/src/store/traits.rs    |  57 ++
 .../postgres/0036_keyword_moderation.sql      |  34 +
 crates/llm-access-migrations/src/lib.rs       |   5 +
 crates/llm-access-store/src/postgres.rs       |   1 +
 .../src/postgres/moderation.rs                | 335 ++++++++++
 crates/llm-access/src/admin.rs                | 265 ++++++++
 crates/llm-access/src/lib.rs                  |  40 +-
 crates/llm-access/src/moderation.rs           | 450 +++++++++++++
 crates/llm-access/src/provider.rs             |   2 +
 .../provider/anthropic_upstream_dispatch.rs   |  79 ++-
 .../llm-access/src/provider/codex_dispatch.rs |  68 +-
 .../llm-access/src/provider/kiro_dispatch.rs  |  57 +-
 crates/llm-access/src/provider/state.rs       |   8 +
 crates/llm-access/src/runtime.rs              |  32 +-
 29 files changed, 2956 insertions(+), 29 deletions(-)
 create mode 100644 crates/frontend/src/pages/admin_moderation.rs
 create mode 100644 crates/llm-access-core/src/moderation.rs
 create mode 100644 crates/llm-access-core/src/store/moderation.rs
 create mode 100644 crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
 create mode 100644 crates/llm-access-store/src/postgres/moderation.rs
 create mode 100644 crates/llm-access/src/moderation.rs

diff --git a/Cargo.lock b/Cargo.lock
index 74203f3c..d65faa84 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5787,6 +5787,7 @@ dependencies = [
 name = "llm-access-core"
 version = "0.1.0"
 dependencies = [
+ "aho-corasick",
  "anyhow",
  "async-trait",
  "base64 0.22.1",
diff --git a/Cargo.toml b/Cargo.toml
index b6f1dd82..a2cceba8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -47,6 +47,7 @@ httparse = "1"
 lru = "0.16.3"
 once_cell = "1"
 ahash = "0.8.12"
+aho-corasick = "1.1"
 
 # 日志
 log = "0.4"
diff --git a/crates/backend/src/routes.rs b/crates/backend/src/routes.rs
index b9bf2105..c33e993c 100644
--- a/crates/backend/src/routes.rs
+++ b/crates/backend/src/routes.rs
@@ -516,8 +516,10 @@ pub fn create_router(state: AppState) -> Router {
         .route("/api/llm-access/*path", any(crate::llm_access_admin_proxy::proxy_public_request))
         .route("/admin/llm-gateway", get(seo::seo_spa_shell))
         .route("/admin/llm-gateway/monitor", get(seo::seo_spa_shell))
+        .route("/admin/llm-gateway/moderation", get(seo::seo_spa_shell))
         .route("/static_flow/admin/llm-gateway", get(seo::seo_spa_shell))
         .route("/static_flow/admin/llm-gateway/monitor", get(seo::seo_spa_shell))
+        .route("/static_flow/admin/llm-gateway/moderation", get(seo::seo_spa_shell))
         .route("/admin/kiro-gateway", get(seo::seo_spa_shell))
         .route("/admin/kiro-gateway/accounts", any(admin_kiro_accounts_entry))
         .route("/admin/kiro-gateway/upstream-channels", get(seo::seo_spa_shell))
diff --git a/crates/frontend/src/api.rs b/crates/frontend/src/api.rs
index f30e1b5f..7bd4fb78 100644
--- a/crates/frontend/src/api.rs
+++ b/crates/frontend/src/api.rs
@@ -10966,6 +10966,99 @@ pub struct TestAdminAnthropicUpstreamModelInput {
     pub model: String,
 }
 
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationKeywordView {
+    pub id: i64,
+    pub keyword: String,
+    pub note: Option<String>,
+    pub source: String,
+    pub created_at_ms: i64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationGateStatsView {
+    pub loaded: bool,
+    pub loaded_at_ms: Option<i64>,
+    pub keyword_count: usize,
+    pub banned_session_count: usize,
+    pub allowed_session_count: usize,
+    pub blocked_requests_total: u64,
+    pub persist_failures_total: u64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct AdminModerationKeywordsResponse {
+    pub keywords: Vec<ModerationKeywordView>,
+    pub total: usize,
+    pub stats: ModerationGateStatsView,
+    pub generated_at: i64,
+}
+
+#[derive(Debug, Serialize, Clone, PartialEq, Default)]
+pub struct AddAdminModerationKeywordsInput {
+    pub content: String,
+    pub format: Option<String>,
+    pub note: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct AddAdminModerationKeywordsResponse {
+    pub inserted: usize,
+    pub duplicates: usize,
+    pub parsed: usize,
+    pub generated_at: i64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationBannedSessionView {
+    pub id: i64,
+    pub session_key: String,
+    pub provider: String,
+    pub key_id: String,
+    pub key_name: String,
+    pub session_id: String,
+    pub matched_keyword: String,
+    pub matched_context: String,
+    pub endpoint: String,
+    pub model: String,
+    pub client_ip: String,
+    pub status: String,
+    pub review_note: Option<String>,
+    pub banned_at_ms: i64,
+    pub reviewed_at_ms: Option<i64>,
+    pub updated_at_ms: i64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationBannedSessionDetailView {
+    pub session: ModerationBannedSessionView,
+    pub request_headers_json: String,
+    pub request_body_json: String,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct AdminModerationBannedSessionsResponse {
+    pub sessions: Vec<ModerationBannedSessionView>,
+    pub total: usize,
+    pub limit: usize,
+    pub offset: usize,
+    pub has_more: bool,
+    pub generated_at: i64,
+}
+
+#[derive(Debug, Serialize, Clone, PartialEq, Default)]
+pub struct ReviewModerationBannedSessionInput {
+    pub banned: bool,
+    pub review_note: Option<String>,
+}
+
 #[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
 #[serde(default)]
 pub struct KiroAccountView {
@@ -12050,6 +12143,178 @@ pub async fn delete_admin_anthropic_upstream_channel(name: &str) -> Result<(), S
     }
 }
 
+pub async fn fetch_admin_moderation_keywords() -> Result<AdminModerationKeywordsResponse, String> {
+    #[cfg(feature = "mock")]
+    {
+        Ok(AdminModerationKeywordsResponse::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/keywords", llm_access_admin_base());
+        let response = api_get(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn add_admin_moderation_keywords(
+    input: &AddAdminModerationKeywordsInput,
+) -> Result<AddAdminModerationKeywordsResponse, String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = input;
+        Ok(AddAdminModerationKeywordsResponse::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/keywords", llm_access_admin_base());
+        let response = api_post(&url)
+            .json(input)
+            .map_err(|e| format!("Serialize error: {:?}", e))?
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn delete_admin_moderation_keyword(id: i64) -> Result<(), String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = id;
+        Ok(())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/keywords/{id}", llm_access_admin_base());
+        let response = api_delete(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        Ok(())
+    }
+}
+
+pub async fn fetch_admin_moderation_banned_sessions(
+    status: &str,
+    limit: usize,
+    offset: usize,
+) -> Result<AdminModerationBannedSessionsResponse, String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = (status, limit, offset);
+        Ok(AdminModerationBannedSessionsResponse::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!(
+            "{}/admin/llm-gateway/moderation/banned-sessions?status={}&limit={limit}&\
+             offset={offset}",
+            llm_access_admin_base(),
+            urlencoding::encode(status)
+        );
+        let response = api_get(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn fetch_admin_moderation_banned_session(
+    id: i64,
+) -> Result<ModerationBannedSessionDetailView, String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = id;
+        Ok(ModerationBannedSessionDetailView::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!(
+            "{}/admin/llm-gateway/moderation/banned-sessions/{id}",
+            llm_access_admin_base()
+        );
+        let response = api_get(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn review_admin_moderation_banned_session(
+    id: i64,
+    input: &ReviewModerationBannedSessionInput,
+) -> Result<ModerationBannedSessionView, String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = (id, input);
+        Ok(ModerationBannedSessionView::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!(
+            "{}/admin/llm-gateway/moderation/banned-sessions/{id}/review",
+            llm_access_admin_base()
+        );
+        let response = api_post(&url)
+            .json(input)
+            .map_err(|e| format!("Serialize error: {:?}", e))?
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
 pub async fn fetch_admin_kiro_accounts() -> Result<AdminKiroAccountsResponse, String> {
     #[cfg(feature = "mock")]
     {
diff --git a/crates/frontend/src/pages/admin_llm_gateway.rs b/crates/frontend/src/pages/admin_llm_gateway.rs
index 5cd081c7..a04f85c1 100644
--- a/crates/frontend/src/pages/admin_llm_gateway.rs
+++ b/crates/frontend/src/pages/admin_llm_gateway.rs
@@ -6631,6 +6631,7 @@ pub fn admin_llm_gateway_page() -> Html {
                         <div class={classes!("flex", "gap-2", "flex-wrap")}>
                             <Link<Route> to={Route::Admin} classes={classes!("btn-terminal")}>{ "Admin 首页" }</Link<Route>>
                             <Link<Route> to={Route::AdminLlmGatewayMonitor} classes={classes!("btn-terminal")}>{ "监控页" }</Link<Route>>
+                            <Link<Route> to={Route::AdminLlmGatewayModeration} classes={classes!("btn-terminal")}>{ "关键词审核" }</Link<Route>>
                             <Link<Route> to={Route::LlmAccess} classes={classes!("btn-terminal", "btn-terminal-primary")}>{ "公共页" }</Link<Route>>
                         </div>
                     </div>
diff --git a/crates/frontend/src/pages/admin_moderation.rs b/crates/frontend/src/pages/admin_moderation.rs
new file mode 100644
index 00000000..1b14160c
--- /dev/null
+++ b/crates/frontend/src/pages/admin_moderation.rs
@@ -0,0 +1,590 @@
+//! Keyword moderation review console.
+//!
+//! Two tabs: **Keywords** (import via txt/json, list, delete) and
+//! **Banned sessions** (list captured bans, inspect the full request payload,
+//! keep or lift a ban). Backed by the `/admin/llm-gateway/moderation/*`
+//! endpoints on the cloud `llm-access` service.
+
+use web_sys::{HtmlInputElement, HtmlSelectElement, HtmlTextAreaElement};
+use yew::prelude::*;
+use yew_router::prelude::Link;
+
+use crate::{
+    api::{
+        add_admin_moderation_keywords, delete_admin_moderation_keyword,
+        fetch_admin_moderation_banned_session, fetch_admin_moderation_banned_sessions,
+        fetch_admin_moderation_keywords, review_admin_moderation_banned_session,
+        AddAdminModerationKeywordsInput, AdminModerationBannedSessionsResponse,
+        AdminModerationKeywordsResponse, ModerationBannedSessionDetailView,
+        ReviewModerationBannedSessionInput,
+    },
+    components::tab_bar::render_tab_bar,
+    pages::llm_access_shared::{confirm_destructive, format_timestamp_opt},
+    router::Route,
+};
+
+const TAB_KEYWORDS: &str = "keywords";
+const TAB_SESSIONS: &str = "sessions";
+
+fn provider_badge(provider: &str) -> Classes {
+    let base = classes!("rounded-full", "px-2", "py-1", "font-mono", "text-xs", "font-semibold");
+    let color = if provider == "codex" {
+        classes!("bg-sky-500/10", "text-sky-700", "dark:text-sky-200")
+    } else {
+        classes!("bg-violet-500/10", "text-violet-700", "dark:text-violet-200")
+    };
+    classes!(base, color)
+}
+
+fn status_badge(status: &str) -> Classes {
+    let base = classes!("rounded-full", "px-2", "py-1", "font-mono", "text-xs");
+    let color = if status == "banned" {
+        classes!("bg-red-500/10", "text-red-700", "dark:text-red-200")
+    } else {
+        classes!("bg-emerald-500/10", "text-emerald-700", "dark:text-emerald-200")
+    };
+    classes!(base, color)
+}
+
+fn pretty_json(raw: &str) -> String {
+    serde_json::from_str::<serde_json::Value>(raw)
+        .ok()
+        .and_then(|value| serde_json::to_string_pretty(&value).ok())
+        .unwrap_or_else(|| raw.to_string())
+}
+
+#[function_component(AdminModerationPage)]
+pub fn admin_moderation_page() -> Html {
+    let active_tab = use_state(|| TAB_KEYWORDS.to_string());
+    let error = use_state(|| None::<String>);
+    let flash = use_state(|| None::<String>);
+    let refresh_tick = use_state(|| 0u64);
+
+    // Keyword tab state.
+    let keywords = use_state(AdminModerationKeywordsResponse::default);
+    let keywords_loading = use_state(|| true);
+    let import_content = use_state(String::new);
+    let import_format = use_state(|| "txt".to_string());
+    let import_note = use_state(String::new);
+    let importing = use_state(|| false);
+
+    // Banned session tab state.
+    let sessions = use_state(AdminModerationBannedSessionsResponse::default);
+    let sessions_loading = use_state(|| true);
+    let session_status = use_state(|| "banned".to_string());
+    let selected_detail = use_state(|| None::<ModerationBannedSessionDetailView>);
+    let detail_loading = use_state(|| false);
+
+    let notify = {
+        let flash = flash.clone();
+        let error = error.clone();
+        Callback::from(move |(message, is_error): (String, bool)| {
+            if is_error {
+                error.set(Some(message));
+                flash.set(None);
+            } else {
+                flash.set(Some(message));
+                error.set(None);
+            }
+        })
+    };
+
+    let reload = {
+        let refresh_tick = refresh_tick.clone();
+        Callback::from(move |_| refresh_tick.set((*refresh_tick).saturating_add(1)))
+    };
+
+    // Load keywords.
+    {
+        let keywords = keywords.clone();
+        let keywords_loading = keywords_loading.clone();
+        let error = error.clone();
+        let tick = *refresh_tick;
+        use_effect_with(tick, move |_| {
+            keywords_loading.set(true);
+            wasm_bindgen_futures::spawn_local(async move {
+                match fetch_admin_moderation_keywords().await {
+                    Ok(response) => keywords.set(response),
+                    Err(message) => error.set(Some(message)),
+                }
+                keywords_loading.set(false);
+            });
+            || ()
+        });
+    }
+
+    // Load banned sessions (re-runs on tick or status filter change).
+    {
+        let sessions = sessions.clone();
+        let sessions_loading = sessions_loading.clone();
+        let error = error.clone();
+        let status = (*session_status).clone();
+        let deps = (*refresh_tick, status.clone());
+        use_effect_with(deps, move |_| {
+            sessions_loading.set(true);
+            wasm_bindgen_futures::spawn_local(async move {
+                match fetch_admin_moderation_banned_sessions(&status, 100, 0).await {
+                    Ok(response) => sessions.set(response),
+                    Err(message) => error.set(Some(message)),
+                }
+                sessions_loading.set(false);
+            });
+            || ()
+        });
+    }
+
+    let on_tab_click = {
+        let active_tab = active_tab.clone();
+        Callback::from(move |tab: String| active_tab.set(tab))
+    };
+
+    let on_import = {
+        let import_content = import_content.clone();
+        let import_format = import_format.clone();
+        let import_note = import_note.clone();
+        let importing = importing.clone();
+        let notify = notify.clone();
+        let reload = reload.clone();
+        Callback::from(move |_| {
+            if *importing {
+                return;
+            }
+            let content = (*import_content).clone();
+            if content.trim().is_empty() {
+                notify.emit(("Keyword content is empty".to_string(), true));
+                return;
+            }
+            let note = (*import_note).clone();
+            let input = AddAdminModerationKeywordsInput {
+                content,
+                format: Some((*import_format).clone()),
+                note: (!note.trim().is_empty()).then(|| note.trim().to_string()),
+            };
+            let importing = importing.clone();
+            let notify = notify.clone();
+            let reload = reload.clone();
+            let import_content = import_content.clone();
+            importing.set(true);
+            wasm_bindgen_futures::spawn_local(async move {
+                match add_admin_moderation_keywords(&input).await {
+                    Ok(outcome) => {
+                        notify.emit((
+                            format!(
+                                "Imported {} keyword(s), {} duplicate(s) skipped (parsed {})",
+                                outcome.inserted, outcome.duplicates, outcome.parsed
+                            ),
+                            false,
+                        ));
+                        import_content.set(String::new());
+                        reload.emit(());
+                    },
+                    Err(message) => notify.emit((message, true)),
+                }
+                importing.set(false);
+            });
+        })
+    };
+
+    let keywords_view = {
+        let import_content = import_content.clone();
+        let import_format = import_format.clone();
+        let import_note = import_note.clone();
+        let importing = importing.clone();
+        let keywords = keywords.clone();
+        let keywords_loading = keywords_loading.clone();
+        let notify = notify.clone();
+        let reload = reload.clone();
+
+        let on_content_input = {
+            let import_content = import_content.clone();
+            Callback::from(move |e: InputEvent| {
+                let target: HtmlTextAreaElement = e.target_unchecked_into();
+                import_content.set(target.value());
+            })
+        };
+        let on_format_change = {
+            let import_format = import_format.clone();
+            Callback::from(move |e: Event| {
+                let target: HtmlSelectElement = e.target_unchecked_into();
+                import_format.set(target.value());
+            })
+        };
+        let on_note_input = {
+            let import_note = import_note.clone();
+            Callback::from(move |e: InputEvent| {
+                let target: HtmlInputElement = e.target_unchecked_into();
+                import_note.set(target.value());
+            })
+        };
+
+        let stats = keywords.stats.clone();
+        html! {
+            <div class={classes!("space-y-4")}>
+                <div class={classes!("grid", "gap-3", "sm:grid-cols-2", "lg:grid-cols-4")}>
+                    { stat_card("Keywords", stats.keyword_count.to_string(), stats.loaded) }
+                    { stat_card("Banned sessions", stats.banned_session_count.to_string(), stats.loaded) }
+                    { stat_card("Allowlisted", stats.allowed_session_count.to_string(), stats.loaded) }
+                    { stat_card("Blocked requests", stats.blocked_requests_total.to_string(), stats.loaded) }
+                </div>
+
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-5", "space-y-3")}>
+                    <h3 class={classes!("font-mono", "text-xs", "uppercase", "tracking-[0.16em]", "text-[var(--muted)]")}>
+                        { "Import keywords" }
+                    </h3>
+                    <textarea
+                        class={classes!("w-full", "min-h-[8rem]", "rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "p-3", "font-mono", "text-sm")}
+                        placeholder={"txt: one keyword (or space-separated phrase) per line\njson: [\"phrase a\", \"phrase b\"] or {\"keywords\": [...]}"}
+                        value={(*import_content).clone()}
+                        oninput={on_content_input}
+                    />
+                    <div class={classes!("flex", "flex-wrap", "items-center", "gap-3")}>
+                        <select
+                            class={classes!("rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                            onchange={on_format_change}
+                        >
+                            <option value="txt" selected={*import_format == "txt"}>{ "Plain text (.txt)" }</option>
+                            <option value="json" selected={*import_format == "json"}>{ "JSON" }</option>
+                        </select>
+                        <input
+                            type="text"
+                            class={classes!("flex-1", "min-w-[12rem]", "rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                            placeholder="Optional note for this batch"
+                            value={(*import_note).clone()}
+                            oninput={on_note_input}
+                        />
+                        <button
+                            type="button"
+                            class={classes!("btn-terminal", "btn-terminal-primary")}
+                            disabled={*importing}
+                            onclick={on_import}
+                        >
+                            { if *importing { "Importing…" } else { "Import" } }
+                        </button>
+                    </div>
+                </div>
+
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "overflow-hidden")}>
+                    if *keywords_loading {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "Loading keywords…" }</div>
+                    } else if keywords.keywords.is_empty() {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "No keywords configured." }</div>
+                    } else {
+                        <div class={classes!("overflow-x-auto")}>
+                            <table class={classes!("w-full", "min-w-[40rem]", "text-sm")}>
+                                <thead>
+                                    <tr class={classes!("border-b", "border-[var(--border)]", "text-left", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>
+                                        <th class={classes!("px-4", "py-2")}>{ "Keyword" }</th>
+                                        <th class={classes!("px-4", "py-2")}>{ "Source" }</th>
+                                        <th class={classes!("px-4", "py-2")}>{ "Note" }</th>
+                                        <th class={classes!("px-4", "py-2")}>{ "Added" }</th>
+                                        <th class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    { for keywords.keywords.iter().map(|keyword| {
+                                        let id = keyword.id;
+                                        let keyword_text = keyword.keyword.clone();
+                                        let on_delete = {
+                                            let notify = notify.clone();
+                                            let reload = reload.clone();
+                                            let keyword_text = keyword_text.clone();
+                                            Callback::from(move |_| {
+                                                if !confirm_destructive(&format!("Delete keyword \"{keyword_text}\"?")) {
+                                                    return;
+                                                }
+                                                let notify = notify.clone();
+                                                let reload = reload.clone();
+                                                wasm_bindgen_futures::spawn_local(async move {
+                                                    match delete_admin_moderation_keyword(id).await {
+                                                        Ok(()) => {
+                                                            notify.emit(("Keyword deleted".to_string(), false));
+                                                            reload.emit(());
+                                                        },
+                                                        Err(message) => notify.emit((message, true)),
+                                                    }
+                                                });
+                                            })
+                                        };
+                                        html! {
+                                            <tr class={classes!("border-b", "border-[var(--border)]/50")}>
+                                                <td class={classes!("px-4", "py-2", "font-mono", "break-all")}>{ &keyword.keyword }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ &keyword.source }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ keyword.note.clone().unwrap_or_default() }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]", "whitespace-nowrap")}>{ format_timestamp_opt(Some(keyword.created_at_ms)) }</td>
+                                                <td class={classes!("px-4", "py-2", "text-right")}>
+                                                    <button type="button" class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")} onclick={on_delete}>
+                                                        { "Delete" }
+                                                    </button>
+                                                </td>
+                                            </tr>
+                                        }
+                                    }) }
+                                </tbody>
+                            </table>
+                        </div>
+                    }
+                </div>
+            </div>
+        }
+    };
+
+    let sessions_view = {
+        let sessions = sessions.clone();
+        let sessions_loading = sessions_loading.clone();
+        let session_status = session_status.clone();
+        let selected_detail = selected_detail.clone();
+        let detail_loading = detail_loading.clone();
+        let notify = notify.clone();
+        let reload = reload.clone();
+
+        let on_status_change = {
+            let session_status = session_status.clone();
+            Callback::from(move |e: Event| {
+                let target: HtmlSelectElement = e.target_unchecked_into();
+                session_status.set(target.value());
+            })
+        };
+
+        html! {
+            <div class={classes!("space-y-4")}>
+                <div class={classes!("flex", "items-center", "gap-3")}>
+                    <span class={classes!("font-mono", "text-xs", "uppercase", "tracking-[0.16em]", "text-[var(--muted)]")}>{ "Filter" }</span>
+                    <select
+                        class={classes!("rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                        onchange={on_status_change}
+                    >
+                        <option value="banned" selected={*session_status == "banned"}>{ "Banned" }</option>
+                        <option value="unbanned" selected={*session_status == "unbanned"}>{ "Unbanned" }</option>
+                        <option value="all" selected={*session_status == "all"}>{ "All" }</option>
+                    </select>
+                    <span class={classes!("text-sm", "text-[var(--muted)]")}>
+                        { format!("{} record(s)", sessions.total) }
+                    </span>
+                </div>
+
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "overflow-hidden")}>
+                    if *sessions_loading {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "Loading banned sessions…" }</div>
+                    } else if sessions.sessions.is_empty() {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "No banned sessions." }</div>
+                    } else {
+                        <div class={classes!("overflow-x-auto")}>
+                            <table class={classes!("w-full", "min-w-[60rem]", "text-sm")}>
+                                <thead>
+                                    <tr class={classes!("border-b", "border-[var(--border)]", "text-left", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>
+                                        <th class={classes!("px-4", "py-2")}>{ "Provider" }</th>
+                                        <th class={classes!("px-4", "py-2")}>{ "Key" }</th>
+                                        <th class={classes!("px-4", "py-2")}>{ "Matched keyword" }</th>
+                                        <th class={classes!("px-4", "py-2")}>{ "Status" }</th>
+                                        <th class={classes!("px-4", "py-2")}>{ "Banned at" }</th>
+                                        <th class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    { for sessions.sessions.iter().map(|session| {
+                                        let id = session.id;
+                                        let is_banned = session.status == "banned";
+
+                                        let on_view = {
+                                            let selected_detail = selected_detail.clone();
+                                            let detail_loading = detail_loading.clone();
+                                            let notify = notify.clone();
+                                            Callback::from(move |_| {
+                                                let selected_detail = selected_detail.clone();
+                                                let detail_loading = detail_loading.clone();
+                                                let notify = notify.clone();
+                                                detail_loading.set(true);
+                                                wasm_bindgen_futures::spawn_local(async move {
+                                                    match fetch_admin_moderation_banned_session(id).await {
+                                                        Ok(detail) => selected_detail.set(Some(detail)),
+                                                        Err(message) => notify.emit((message, true)),
+                                                    }
+                                                    detail_loading.set(false);
+                                                });
+                                            })
+                                        };
+
+                                        let on_toggle = {
+                                            let notify = notify.clone();
+                                            let reload = reload.clone();
+                                            Callback::from(move |_| {
+                                                let target_banned = !is_banned;
+                                                let verb = if target_banned { "re-ban" } else { "unban" };
+                                                if !confirm_destructive(&format!("Are you sure you want to {verb} this session?")) {
+                                                    return;
+                                                }
+                                                let input = ReviewModerationBannedSessionInput {
+                                                    banned: target_banned,
+                                                    review_note: None,
+                                                };
+                                                let notify = notify.clone();
+                                                let reload = reload.clone();
+                                                wasm_bindgen_futures::spawn_local(async move {
+                                                    match review_admin_moderation_banned_session(id, &input).await {
+                                                        Ok(_) => {
+                                                            notify.emit((
+                                                                if target_banned { "Session re-banned".to_string() } else { "Session unbanned".to_string() },
+                                                                false,
+                                                            ));
+                                                            reload.emit(());
+                                                        },
+                                                        Err(message) => notify.emit((message, true)),
+                                                    }
+                                                });
+                                            })
+                                        };
+
+                                        html! {
+                                            <tr class={classes!("border-b", "border-[var(--border)]/50")}>
+                                                <td class={classes!("px-4", "py-2")}>
+                                                    <span class={provider_badge(&session.provider)}>{ &session.provider }</span>
+                                                </td>
+                                                <td class={classes!("px-4", "py-2")}>
+                                                    <div class={classes!("font-mono", "text-xs", "break-all")}>{ &session.key_name }</div>
+                                                    <div class={classes!("font-mono", "text-[10px]", "text-[var(--muted)]", "break-all")}>{ &session.key_id }</div>
+                                                </td>
+                                                <td class={classes!("px-4", "py-2", "font-mono", "text-xs", "break-all")}>{ &session.matched_keyword }</td>
+                                                <td class={classes!("px-4", "py-2")}>
+                                                    <span class={status_badge(&session.status)}>{ &session.status }</span>
+                                                </td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]", "whitespace-nowrap")}>{ format_timestamp_opt(Some(session.banned_at_ms)) }</td>
+                                                <td class={classes!("px-4", "py-2", "text-right", "space-x-2", "whitespace-nowrap")}>
+                                                    <button type="button" class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")} onclick={on_view}>
+                                                        { "View" }
+                                                    </button>
+                                                    <button
+                                                        type="button"
+                                                        class={classes!("btn-terminal", if is_banned { "btn-terminal-primary" } else { "" }, "!px-2.5", "!py-1.5", "!text-xs")}
+                                                        onclick={on_toggle}
+                                                    >
+                                                        { if is_banned { "Unban" } else { "Re-ban" } }
+                                                    </button>
+                                                </td>
+                                            </tr>
+                                        }
+                                    }) }
+                                </tbody>
+                            </table>
+                        </div>
+                    }
+                </div>
+
+                { detail_panel(&selected_detail, *detail_loading) }
+            </div>
+        }
+    };
+
+    html! {
+        <main class={classes!("min-h-screen", "bg-[var(--bg)]", "p-4")}>
+            <div class={classes!("mx-auto", "max-w-7xl", "space-y-4")}>
+                <div class={classes!("flex", "flex-wrap", "items-center", "justify-between", "gap-3")}>
+                    <div>
+                        <h1 class={classes!("text-xl", "font-semibold")}>{ "Keyword moderation" }</h1>
+                        <p class={classes!("text-sm", "text-[var(--muted)]")}>
+                            { "Block requests whose content matches banned keywords, and review flagged sessions." }
+                        </p>
+                    </div>
+                    <div class={classes!("flex", "items-center", "gap-2")}>
+                        <Link<Route> to={Route::AdminLlmGateway} classes={classes!("btn-terminal")}>
+                            { "← LLM Gateway" }
+                        </Link<Route>>
+                        <button type="button" class={classes!("btn-terminal")} onclick={reload.reform(|_| ())}>
+                            { "Refresh" }
+                        </button>
+                    </div>
+                </div>
+
+                if let Some(message) = (*flash).clone() {
+                    <div class={classes!("rounded-lg", "bg-emerald-500/10", "px-3", "py-2", "text-sm", "text-emerald-700", "dark:text-emerald-200")}>
+                        { message }
+                    </div>
+                }
+                if let Some(err) = (*error).clone() {
+                    <div class={classes!("rounded-lg", "bg-red-500/10", "px-3", "py-2", "text-sm", "text-red-700", "dark:text-red-200")}>
+                        { err }
+                    </div>
+                }
+
+                { render_tab_bar(
+                    &active_tab,
+                    &[(TAB_KEYWORDS, "Keywords"), (TAB_SESSIONS, "Banned sessions")],
+                    &on_tab_click,
+                    None,
+                ) }
+
+                if *active_tab == TAB_KEYWORDS {
+                    { keywords_view }
+                } else {
+                    { sessions_view }
+                }
+            </div>
+        </main>
+    }
+}
+
+fn stat_card(label: &str, value: String, loaded: bool) -> Html {
+    html! {
+        <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-4")}>
+            <div class={classes!("font-mono", "text-xs", "uppercase", "tracking-[0.16em]", "text-[var(--muted)]")}>{ label.to_string() }</div>
+            <div class={classes!("mt-1", "text-2xl", "font-semibold")}>{ if loaded { value } else { "…".to_string() } }</div>
+        </div>
+    }
+}
+
+fn detail_panel(
+    detail: &UseStateHandle<Option<ModerationBannedSessionDetailView>>,
+    loading: bool,
+) -> Html {
+    if loading {
+        return html! {
+            <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-5", "text-sm", "text-[var(--muted)]")}>
+                { "Loading captured request…" }
+            </div>
+        };
+    }
+    let Some(detail) = (**detail).clone() else {
+        return Html::default();
+    };
+    let session = &detail.session;
+    html! {
+        <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-5", "space-y-3")}>
+            <div class={classes!("flex", "flex-wrap", "items-center", "justify-between", "gap-2")}>
+                <h3 class={classes!("font-mono", "text-sm", "font-semibold")}>
+                    { format!("Captured request · session #{}", session.id) }
+                </h3>
+                <span class={status_badge(&session.status)}>{ &session.status }</span>
+            </div>
+            <div class={classes!("grid", "gap-2", "sm:grid-cols-2", "text-sm")}>
+                { detail_field("Provider", &session.provider) }
+                { detail_field("Endpoint", &session.endpoint) }
+                { detail_field("Model", &session.model) }
+                { detail_field("Client IP", &session.client_ip) }
+                { detail_field("Session id", &session.session_id) }
+                { detail_field("Matched keyword", &session.matched_keyword) }
+            </div>
+            if !session.matched_context.is_empty() {
+                <div>
+                    <div class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]", "mb-1")}>{ "Matched context" }</div>
+                    <pre class={classes!("rounded-lg", "bg-[var(--bg)]", "p-3", "text-xs", "whitespace-pre-wrap", "break-words")}>{ &session.matched_context }</pre>
+                </div>
+            }
+            <div>
+                <div class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]", "mb-1")}>{ "Request headers" }</div>
+                <pre class={classes!("max-h-64", "overflow-auto", "rounded-lg", "bg-[var(--bg)]", "p-3", "text-xs")}>{ pretty_json(&detail.request_headers_json) }</pre>
+            </div>
+            <div>
+                <div class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]", "mb-1")}>{ "Request body" }</div>
+                <pre class={classes!("max-h-96", "overflow-auto", "rounded-lg", "bg-[var(--bg)]", "p-3", "text-xs")}>{ pretty_json(&detail.request_body_json) }</pre>
+            </div>
+        </div>
+    }
+}
+
+fn detail_field(label: &str, value: &str) -> Html {
+    html! {
+        <div>
+            <span class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>{ label.to_string() }{ ": " }</span>
+            <span class={classes!("font-mono", "break-all")}>{ if value.is_empty() { "-" } else { value } }</span>
+        </div>
+    }
+}
diff --git a/crates/frontend/src/pages/mod.rs b/crates/frontend/src/pages/mod.rs
index 3653c6a2..0306166f 100644
--- a/crates/frontend/src/pages/mod.rs
+++ b/crates/frontend/src/pages/mod.rs
@@ -11,6 +11,7 @@ pub mod admin_llm_gateway_monitor;
 pub mod admin_local_media;
 #[cfg(feature = "local-media")]
 pub mod admin_local_media_player;
+pub mod admin_moderation;
 pub mod admin_music_wish_stream;
 pub mod article_detail;
 pub mod article_raw;
diff --git a/crates/frontend/src/router.rs b/crates/frontend/src/router.rs
index 325036dd..4744abfb 100644
--- a/crates/frontend/src/router.rs
+++ b/crates/frontend/src/router.rs
@@ -143,6 +143,13 @@ pub enum Route {
     #[at("/static_flow/admin/llm-gateway/monitor")]
     AdminLlmGatewayMonitor,
 
+    #[cfg(not(feature = "mock"))]
+    #[at("/admin/llm-gateway/moderation")]
+    AdminLlmGatewayModeration,
+    #[cfg(feature = "mock")]
+    #[at("/static_flow/admin/llm-gateway/moderation")]
+    AdminLlmGatewayModeration,
+
     #[cfg(not(feature = "mock"))]
     #[at("/admin/kiro-gateway")]
     AdminKiroGateway,
@@ -290,6 +297,9 @@ fn switch(route: Route) -> Html {
         Route::AdminLlmGatewayMonitor => {
             html! { <pages::admin_llm_gateway_monitor::AdminLlmGatewayMonitorPage /> }
         },
+        Route::AdminLlmGatewayModeration => {
+            html! { <pages::admin_moderation::AdminModerationPage /> }
+        },
         Route::AdminKiroGateway => html! { <pages::admin_kiro_gateway::AdminKiroGatewayPage /> },
         Route::AdminKiroAnthropicUpstreams => {
             html! { <pages::admin_kiro_anthropic_upstreams::AdminKiroAnthropicUpstreamsPage /> }
diff --git a/crates/frontend/src/seo.rs b/crates/frontend/src/seo.rs
index 5e38ad26..4424b162 100644
--- a/crates/frontend/src/seo.rs
+++ b/crates/frontend/src/seo.rs
@@ -292,6 +292,7 @@ fn route_path_for(route: &Route) -> String {
         Route::Admin => config::route_path("/admin"),
         Route::AdminLlmGateway => config::route_path("/admin/llm-gateway"),
         Route::AdminLlmGatewayMonitor => config::route_path("/admin/llm-gateway/monitor"),
+        Route::AdminLlmGatewayModeration => config::route_path("/admin/llm-gateway/moderation"),
         Route::AdminKiroGateway => config::route_path("/admin/kiro-gateway"),
         Route::AdminKiroAccountStatus => config::route_path("/admin/kiro-gateway/accounts"),
         Route::AdminKiroAnthropicUpstreams => {
@@ -511,6 +512,7 @@ pub fn apply_route_seo(route: Option<&Route>) {
         Route::Admin
         | Route::AdminLlmGateway
         | Route::AdminLlmGatewayMonitor
+        | Route::AdminLlmGatewayModeration
         | Route::AdminKiroGateway
         | Route::AdminKiroAccountStatus
         | Route::AdminKiroAnthropicUpstreams
diff --git a/crates/llm-access-core/Cargo.toml b/crates/llm-access-core/Cargo.toml
index 894b1f3c..fa0abb62 100644
--- a/crates/llm-access-core/Cargo.toml
+++ b/crates/llm-access-core/Cargo.toml
@@ -8,6 +8,7 @@ publish = false
 workspace = true
 
 [dependencies]
+aho-corasick = { workspace = true }
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 base64 = "0.22.1"
diff --git a/crates/llm-access-core/src/lib.rs b/crates/llm-access-core/src/lib.rs
index 696cc385..d32634d2 100644
--- a/crates/llm-access-core/src/lib.rs
+++ b/crates/llm-access-core/src/lib.rs
@@ -1,5 +1,6 @@
 //! Shared contracts for the standalone LLM access service.
 
+pub mod moderation;
 pub mod provider;
 pub mod proxy;
 pub mod routes;
diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
new file mode 100644
index 00000000..16a0f870
--- /dev/null
+++ b/crates/llm-access-core/src/moderation.rs
@@ -0,0 +1,416 @@
+//! Keyword moderation matching primitives shared by the request hot path and
+//! the admin import surface.
+//!
+//! Matching is phrase-oriented rather than raw `contains`: request text is
+//! reduced to a normalized form (lowercased, whitespace runs collapsed to a
+//! single space) and scanned once with an Aho-Corasick automaton over all
+//! configured keywords. Matches whose pattern edges are ASCII word characters
+//! additionally require a word boundary in the haystack, so a keyword like
+//! `ass` does not fire inside `class`, while CJK phrases match freely.
+
+use aho_corasick::{AhoCorasick, AhoCorasickBuilder, MatchKind};
+use serde_json::Value;
+
+/// Number of characters kept on each side of a keyword hit when building the
+/// reviewer-facing context snippet.
+const MATCH_CONTEXT_RADIUS_CHARS: usize = 80;
+
+/// JSON object keys whose string values count as user-visible request text.
+const MODERATION_TEXT_KEYS: [&str; 4] = ["text", "content", "instructions", "system"];
+
+/// One keyword hit inside normalized request text.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ModerationMatch {
+    /// Index of the matched pattern in the order passed to
+    /// [`ModerationMatcher::build`].
+    pub pattern_index: usize,
+    /// The normalized keyword that fired.
+    pub keyword: String,
+    /// Context snippet around the hit taken from the normalized text.
+    pub context: String,
+}
+
+/// Compiled multi-pattern keyword matcher.
+pub struct ModerationMatcher {
+    automaton: AhoCorasick,
+    patterns: Vec<String>,
+}
+
+impl std::fmt::Debug for ModerationMatcher {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ModerationMatcher")
+            .field("patterns", &self.patterns.len())
+            .finish()
+    }
+}
+
+impl ModerationMatcher {
+    /// Compile normalized keywords into one scan automaton. Empty patterns are
+    /// skipped; returns `None` when no usable pattern remains.
+    pub fn build<I, S>(keywords: I) -> anyhow::Result<Option<Self>>
+    where
+        I: IntoIterator<Item = S>,
+        S: AsRef<str>,
+    {
+        let patterns: Vec<String> = keywords
+            .into_iter()
+            .map(|keyword| normalize_moderation_text(keyword.as_ref()))
+            .filter(|keyword| !keyword.is_empty())
+            .collect();
+        if patterns.is_empty() {
+            return Ok(None);
+        }
+        let automaton = AhoCorasickBuilder::new()
+            .match_kind(MatchKind::Standard)
+            .build(&patterns)
+            .map_err(|err| anyhow::anyhow!("build moderation keyword automaton: {err}"))?;
+        Ok(Some(Self {
+            automaton,
+            patterns,
+        }))
+    }
+
+    /// Number of compiled patterns.
+    pub fn pattern_count(&self) -> usize {
+        self.patterns.len()
+    }
+
+    /// Scan normalized text and return the first phrase hit that passes the
+    /// word-boundary check.
+    pub fn find(&self, normalized_text: &str) -> Option<ModerationMatch> {
+        let haystack = normalized_text.as_bytes();
+        for candidate in self.automaton.find_overlapping_iter(normalized_text) {
+            let pattern = self.patterns[candidate.pattern().as_usize()].as_bytes();
+            if !match_respects_word_boundaries(
+                haystack,
+                candidate.start(),
+                candidate.end(),
+                pattern,
+            ) {
+                continue;
+            }
+            let pattern_index = candidate.pattern().as_usize();
+            return Some(ModerationMatch {
+                pattern_index,
+                keyword: self.patterns[pattern_index].clone(),
+                context: match_context_snippet(normalized_text, candidate.start(), candidate.end()),
+            });
+        }
+        None
+    }
+}
+
+fn is_ascii_word_byte(byte: u8) -> bool {
+    byte.is_ascii_alphanumeric() || byte == b'_'
+}
+
+/// A pattern edge that is an ASCII word character must sit on a word boundary
+/// in the haystack; non-ASCII edges (e.g. CJK) never require one.
+fn match_respects_word_boundaries(
+    haystack: &[u8],
+    start: usize,
+    end: usize,
+    pattern: &[u8],
+) -> bool {
+    let Some((&first, &last)) = pattern.first().zip(pattern.last()) else {
+        return false;
+    };
+    if is_ascii_word_byte(first) && start > 0 && is_ascii_word_byte(haystack[start - 1]) {
+        return false;
+    }
+    if is_ascii_word_byte(last) && end < haystack.len() && is_ascii_word_byte(haystack[end]) {
+        return false;
+    }
+    true
+}
+
+fn match_context_snippet(text: &str, start: usize, end: usize) -> String {
+    let snippet_start = {
+        let mut cursor = start;
+        for _ in 0..MATCH_CONTEXT_RADIUS_CHARS {
+            match text[..cursor].char_indices().next_back() {
+                Some((index, _)) => cursor = index,
+                None => break,
+            }
+        }
+        cursor
+    };
+    let snippet_end = {
+        let mut cursor = end;
+        for _ in 0..MATCH_CONTEXT_RADIUS_CHARS {
+            match text[cursor..].chars().next() {
+                Some(ch) => cursor += ch.len_utf8(),
+                None => break,
+            }
+        }
+        cursor
+    };
+    let mut snippet = String::new();
+    if snippet_start > 0 {
+        snippet.push('…');
+    }
+    snippet.push_str(&text[snippet_start..snippet_end]);
+    if snippet_end < text.len() {
+        snippet.push('…');
+    }
+    snippet
+}
+
+/// Lowercase text and collapse every whitespace run into one ASCII space so
+/// phrase keywords match regardless of formatting.
+pub fn normalize_moderation_text(text: &str) -> String {
+    let mut normalized = String::with_capacity(text.len());
+    let mut pending_space = false;
+    for ch in text.chars() {
+        if ch.is_whitespace() {
+            pending_space = !normalized.is_empty();
+            continue;
+        }
+        if pending_space {
+            normalized.push(' ');
+            pending_space = false;
+        }
+        for lower in ch.to_lowercase() {
+            normalized.push(lower);
+        }
+    }
+    normalized
+}
+
+/// Collect user-visible text from a request body JSON value.
+///
+/// Walks the value tree and gathers string values stored under
+/// `text` / `content` / `instructions` / `system` keys, which covers Anthropic
+/// messages (`system`, content blocks), OpenAI chat completions
+/// (`messages[].content`, string or `text` parts) and Codex responses
+/// (`instructions`, `input[].content[].text`) without dragging JSON structure
+/// noise (field names, model ids, tool schemas) into the scan.
+pub fn extract_moderation_text(body: &Value) -> String {
+    let mut collected = String::new();
+    collect_moderation_text(body, &mut collected);
+    collected
+}
+
+fn collect_moderation_text(value: &Value, out: &mut String) {
+    match value {
+        Value::Object(map) => {
+            for (key, child) in map {
+                match child {
+                    Value::String(text)
+                        if MODERATION_TEXT_KEYS.contains(&key.as_str()) && !text.is_empty() =>
+                    {
+                        if !out.is_empty() {
+                            out.push('\n');
+                        }
+                        out.push_str(text);
+                    },
+                    _ => collect_moderation_text(child, out),
+                }
+            }
+        },
+        Value::Array(items) => {
+            for item in items {
+                collect_moderation_text(item, out);
+            }
+        },
+        _ => {},
+    }
+}
+
+/// Parse plain-text keyword input: one keyword per line, inner whitespace
+/// runs are treated as single phrase separators, blank lines are skipped.
+pub fn parse_moderation_keywords_txt(content: &str) -> Vec<String> {
+    let mut keywords = Vec::new();
+    for line in content.lines() {
+        let normalized = normalize_moderation_text(line);
+        if !normalized.is_empty() && !keywords.contains(&normalized) {
+            keywords.push(normalized);
+        }
+    }
+    keywords
+}
+
+/// Parse JSON keyword input. Accepted shapes:
+/// - `["keyword a", "keyword b"]`
+/// - `{"keywords": ["keyword a", …]}`
+/// - `[{"keyword": "…"}, {"word": "…"}, {"text": "…"}]` (fields tried in that
+///   order per object)
+pub fn parse_moderation_keywords_json(content: &str) -> anyhow::Result<Vec<String>> {
+    let value: Value = serde_json::from_str(content)
+        .map_err(|err| anyhow::anyhow!("keyword JSON is invalid: {err}"))?;
+    let items = match &value {
+        Value::Array(items) => items.as_slice(),
+        Value::Object(map) => match map.get("keywords") {
+            Some(Value::Array(items)) => items.as_slice(),
+            _ => anyhow::bail!("keyword JSON object must contain a `keywords` array"),
+        },
+        _ => anyhow::bail!("keyword JSON must be an array or an object with a `keywords` array"),
+    };
+    let mut keywords = Vec::new();
+    for item in items {
+        let raw = match item {
+            Value::String(text) => text.as_str(),
+            Value::Object(map) => ["keyword", "word", "text"]
+                .iter()
+                .find_map(|field| map.get(*field).and_then(Value::as_str))
+                .ok_or_else(|| {
+                    anyhow::anyhow!(
+                        "keyword JSON object entries need a `keyword`/`word`/`text` string field"
+                    )
+                })?,
+            other => anyhow::bail!("unsupported keyword JSON entry: {other}"),
+        };
+        let normalized = normalize_moderation_text(raw);
+        if !normalized.is_empty() && !keywords.contains(&normalized) {
+            keywords.push(normalized);
+        }
+    }
+    Ok(keywords)
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    fn matcher(keywords: &[&str]) -> ModerationMatcher {
+        ModerationMatcher::build(keywords.iter().copied())
+            .expect("build matcher")
+            .expect("matcher should have patterns")
+    }
+
+    #[test]
+    fn normalize_collapses_whitespace_and_lowercases() {
+        assert_eq!(
+            normalize_moderation_text("  Hello \t WORLD\nfoo\r\n bar "),
+            "hello world foo bar"
+        );
+        assert_eq!(normalize_moderation_text("你好\u{3000}世界"), "你好 世界");
+        assert_eq!(normalize_moderation_text("   "), "");
+    }
+
+    #[test]
+    fn phrase_match_tolerates_formatting_differences() {
+        let matcher = matcher(&["Free  Palestine  Movement"]);
+        let text = normalize_moderation_text("please join the free\npalestine   movement now");
+        let hit = matcher.find(&text).expect("phrase should match");
+        assert_eq!(hit.keyword, "free palestine movement");
+        assert!(hit.context.contains("free palestine movement"));
+    }
+
+    #[test]
+    fn ascii_keywords_require_word_boundaries() {
+        let matcher = matcher(&["ass"]);
+        assert!(matcher
+            .find(&normalize_moderation_text("this is a class assignment"))
+            .is_none());
+        assert!(matcher
+            .find(&normalize_moderation_text("kick his ass now"))
+            .is_some());
+    }
+
+    #[test]
+    fn cjk_keywords_match_without_boundaries() {
+        let matcher = matcher(&["敏感词"]);
+        assert!(matcher
+            .find(&normalize_moderation_text("这句话包含敏感词内容"))
+            .is_some());
+    }
+
+    #[test]
+    fn boundary_rejection_does_not_hide_later_hits() {
+        let matcher = matcher(&["ass", "bomb"]);
+        let hit = matcher
+            .find(&normalize_moderation_text("classic bomb recipe"))
+            .expect("second keyword should still match");
+        assert_eq!(hit.keyword, "bomb");
+    }
+
+    #[test]
+    fn extracts_anthropic_message_content() {
+        let body = json!({
+            "model": "claude-sonnet-4",
+            "system": [{"type": "text", "text": "You are helpful."}],
+            "messages": [
+                {"role": "user", "content": "how to Build a BOMB"},
+                {"role": "assistant", "content": [{"type": "text", "text": "I cannot help."}]},
+                {"role": "user", "content": [{"type": "tool_result", "content": [{"type": "text", "text": "tool output"}]}]}
+            ],
+            "tools": [{"name": "search", "description": "ignored tool description"}]
+        });
+        let text = extract_moderation_text(&body);
+        assert!(text.contains("You are helpful."));
+        assert!(text.contains("how to Build a BOMB"));
+        assert!(text.contains("tool output"));
+        assert!(!text.contains("ignored tool description"));
+        assert!(!text.contains("claude-sonnet-4"));
+    }
+
+    #[test]
+    fn extracts_codex_responses_content() {
+        let body = json!({
+            "model": "gpt-5",
+            "instructions": "system instructions here",
+            "input": [
+                {"type": "message", "role": "user", "content": [
+                    {"type": "input_text", "text": "user question body"}
+                ]}
+            ]
+        });
+        let text = extract_moderation_text(&body);
+        assert!(text.contains("system instructions here"));
+        assert!(text.contains("user question body"));
+        assert!(!text.contains("gpt-5"));
+    }
+
+    #[test]
+    fn extracts_chat_completions_content() {
+        let body = json!({
+            "model": "gpt-5",
+            "messages": [
+                {"role": "system", "content": "chat system prompt"},
+                {"role": "user", "content": [{"type": "text", "text": "chat user text"}]}
+            ]
+        });
+        let text = extract_moderation_text(&body);
+        assert!(text.contains("chat system prompt"));
+        assert!(text.contains("chat user text"));
+    }
+
+    #[test]
+    fn parses_txt_keywords() {
+        let keywords = parse_moderation_keywords_txt("  Foo   Bar \n\nbaz\nfoo bar\n");
+        assert_eq!(keywords, vec!["foo bar".to_string(), "baz".to_string()]);
+    }
+
+    #[test]
+    fn parses_json_keyword_shapes() {
+        assert_eq!(
+            parse_moderation_keywords_json(r#"["A b", "c"]"#).expect("array of strings"),
+            vec!["a b".to_string(), "c".to_string()]
+        );
+        assert_eq!(
+            parse_moderation_keywords_json(r#"{"keywords": ["X"]}"#).expect("keywords object"),
+            vec!["x".to_string()]
+        );
+        assert_eq!(
+            parse_moderation_keywords_json(r#"[{"keyword": "K"}, {"word": "W"}, {"text": "T"}]"#)
+                .expect("array of objects"),
+            vec!["k".to_string(), "w".to_string(), "t".to_string()]
+        );
+        assert!(parse_moderation_keywords_json("{}").is_err());
+        assert!(parse_moderation_keywords_json("42").is_err());
+        assert!(parse_moderation_keywords_json("not json").is_err());
+    }
+
+    #[test]
+    fn empty_keyword_set_builds_no_matcher() {
+        assert!(ModerationMatcher::build(Vec::<String>::new())
+            .expect("build")
+            .is_none());
+        assert!(ModerationMatcher::build(vec!["   ", "\n"])
+            .expect("build")
+            .is_none());
+    }
+}
diff --git a/crates/llm-access-core/src/store/empty.rs b/crates/llm-access-core/src/store/empty.rs
index 45efc8b8..567aa605 100644
--- a/crates/llm-access-core/src/store/empty.rs
+++ b/crates/llm-access-core/src/store/empty.rs
@@ -31,6 +31,11 @@ use super::{
         AdminKiroBalanceView, AdminKiroCacheView, AdminKiroStatusCacheUpdate,
         KiroStatusRefreshTarget, NewAdminKiroAccount,
     },
+    moderation::{
+        ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
+        ModerationKeyword, ModerationKeywordImportOutcome, ModerationRuntimeSnapshot,
+        NewModerationBannedSession, NewModerationKeyword,
+    },
     proxy::{
         default_proxy_binding, default_proxy_bindings, AdminProxyBinding, AdminProxyConfig,
         AdminProxyConfigPatch, AdminProxyTrafficSnapshot, NewAdminProxyConfig,
@@ -48,10 +53,10 @@ use super::{
     },
     traits::{
         AdminAccountGroupStore, AdminAnthropicUpstreamStore, AdminCodexAccountStore,
-        AdminConfigStore, AdminKeyStore, AdminKiroAccountStore, AdminProxyStore,
-        AdminReviewQueueStore, ProviderRouteStore, PublicAccessStore, PublicCommunityStore,
-        PublicStatusStore, PublicSubmissionStore, PublicUsageStore, UsageAnalyticsStore,
-        UsageEventSink, UsageRollupBatchSink,
+        AdminConfigStore, AdminKeyStore, AdminKiroAccountStore, AdminModerationStore,
+        AdminProxyStore, AdminReviewQueueStore, ProviderRouteStore, PublicAccessStore,
+        PublicCommunityStore, PublicStatusStore, PublicSubmissionStore, PublicUsageStore,
+        UsageAnalyticsStore, UsageEventSink, UsageRollupBatchSink,
     },
     usage::{
         AdminLegacyKiroProxyMigration, ProxyTrafficQuery, ProxyTrafficSnapshot, ProxyTrafficTotals,
@@ -72,6 +77,73 @@ pub struct EmptyProviderRouteStore;
 /// Empty direct Anthropic upstream store used by isolated unit tests.
 pub struct EmptyAdminAnthropicUpstreamStore;
 
+/// Empty keyword moderation store used as the disabled-gate default and in
+/// isolated unit tests.
+pub struct EmptyAdminModerationStore;
+
+#[async_trait]
+impl AdminModerationStore for EmptyAdminModerationStore {
+    async fn load_moderation_runtime_snapshot(&self) -> anyhow::Result<ModerationRuntimeSnapshot> {
+        Ok(ModerationRuntimeSnapshot::default())
+    }
+
+    async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>> {
+        Ok(Vec::new())
+    }
+
+    async fn add_moderation_keywords(
+        &self,
+        _keywords: Vec<NewModerationKeyword>,
+    ) -> anyhow::Result<ModerationKeywordImportOutcome> {
+        anyhow::bail!("moderation store is not configured")
+    }
+
+    async fn delete_moderation_keyword(
+        &self,
+        _id: i64,
+    ) -> anyhow::Result<Option<ModerationKeyword>> {
+        Ok(None)
+    }
+
+    async fn record_moderation_banned_session(
+        &self,
+        _record: NewModerationBannedSession,
+    ) -> anyhow::Result<bool> {
+        anyhow::bail!("moderation store is not configured")
+    }
+
+    async fn list_moderation_banned_sessions(
+        &self,
+        page: AdminPageRequest,
+        _status: Option<&str>,
+    ) -> anyhow::Result<ModerationBannedSessionsPage> {
+        Ok(ModerationBannedSessionsPage {
+            sessions: Vec::new(),
+            total: 0,
+            limit: page.limit,
+            offset: page.offset,
+            has_more: false,
+        })
+    }
+
+    async fn get_moderation_banned_session(
+        &self,
+        _id: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSessionDetail>> {
+        Ok(None)
+    }
+
+    async fn set_moderation_banned_session_status(
+        &self,
+        _id: i64,
+        _status: &str,
+        _review_note: Option<&str>,
+        _reviewed_at_ms: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSession>> {
+        Ok(None)
+    }
+}
+
 #[async_trait]
 impl ProviderRouteStore for EmptyProviderRouteStore {
     async fn resolve_codex_route(
diff --git a/crates/llm-access-core/src/store/mod.rs b/crates/llm-access-core/src/store/mod.rs
index 97c1ebc1..27b36aa8 100644
--- a/crates/llm-access-core/src/store/mod.rs
+++ b/crates/llm-access-core/src/store/mod.rs
@@ -15,6 +15,7 @@ mod groups;
 mod keys;
 mod kiro_account;
 mod kiro_model_routing;
+mod moderation;
 mod proxy;
 mod public;
 mod routes;
@@ -52,10 +53,11 @@ pub use config::{
 };
 pub use empty::{
     EmptyAdminAccountGroupStore, EmptyAdminAnthropicUpstreamStore, EmptyAdminCodexAccountStore,
-    EmptyAdminConfigStore, EmptyAdminKeyStore, EmptyAdminKiroAccountStore, EmptyAdminProxyStore,
-    EmptyAdminReviewQueueStore, EmptyProviderRouteStore, EmptyPublicAccessStore,
-    EmptyPublicCommunityStore, EmptyPublicStatusStore, EmptyPublicSubmissionStore,
-    EmptyPublicUsageStore, EmptyUsageAnalyticsStore, NoopUsageEventSink, NoopUsageRollupBatchSink,
+    EmptyAdminConfigStore, EmptyAdminKeyStore, EmptyAdminKiroAccountStore,
+    EmptyAdminModerationStore, EmptyAdminProxyStore, EmptyAdminReviewQueueStore,
+    EmptyProviderRouteStore, EmptyPublicAccessStore, EmptyPublicCommunityStore,
+    EmptyPublicStatusStore, EmptyPublicSubmissionStore, EmptyPublicUsageStore,
+    EmptyUsageAnalyticsStore, NoopUsageEventSink, NoopUsageRollupBatchSink,
 };
 pub use groups::{
     AdminAccountGroup, AdminAccountGroupOption, AdminAccountGroupPatch, AdminAccountGroupsPage,
@@ -75,6 +77,13 @@ pub use kiro_account::{
 pub use kiro_model_routing::{
     kiro_model_group_preference, normalize_kiro_model_group_preferences, KiroModelGroupPreferences,
 };
+pub use moderation::{
+    ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
+    ModerationKeyword, ModerationKeywordImportOutcome, ModerationRuntimeSnapshot,
+    NewModerationBannedSession, NewModerationKeyword, MODERATION_KEYWORD_SOURCE_JSON,
+    MODERATION_KEYWORD_SOURCE_TXT, MODERATION_SESSION_STATUS_BANNED,
+    MODERATION_SESSION_STATUS_UNBANNED,
+};
 pub use proxy::{
     default_proxy_bindings, AdminProxyBinding, AdminProxyConfig, AdminProxyConfigPatch,
     AdminProxyEndpointCheck, AdminProxyEndpointCheckUpdate, AdminProxyTrafficSnapshot,
@@ -95,10 +104,10 @@ pub use routes::{
 };
 pub use traits::{
     AdminAccountGroupStore, AdminAnthropicUpstreamStore, AdminCodexAccountStore, AdminConfigStore,
-    AdminKeyStore, AdminKiroAccountStore, AdminProxyStore, AdminReviewQueueStore, ControlStore,
-    ProviderRouteStore, PublicAccessStore, PublicCommunityStore, PublicStatusStore,
-    PublicSubmissionStore, PublicUsageStore, UsageAnalyticsStore, UsageEventSink,
-    UsageRollupBatchSink,
+    AdminKeyStore, AdminKiroAccountStore, AdminModerationStore, AdminProxyStore,
+    AdminReviewQueueStore, ControlStore, ProviderRouteStore, PublicAccessStore,
+    PublicCommunityStore, PublicStatusStore, PublicSubmissionStore, PublicUsageStore,
+    UsageAnalyticsStore, UsageEventSink, UsageRollupBatchSink,
 };
 pub use usage::{
     AdminLegacyKiroProxyMigration, KeyUsageRollupDelta, KeyUsageRollupLastUsedCount,
diff --git a/crates/llm-access-core/src/store/moderation.rs b/crates/llm-access-core/src/store/moderation.rs
new file mode 100644
index 00000000..59e9ef18
--- /dev/null
+++ b/crates/llm-access-core/src/store/moderation.rs
@@ -0,0 +1,156 @@
+//! Keyword moderation data model: configured keywords and banned sessions.
+
+use serde::{Deserialize, Serialize};
+
+/// Ban record status: the session is actively blocked.
+pub const MODERATION_SESSION_STATUS_BANNED: &str = "banned";
+/// Ban record status: a reviewer cleared the session; it is allowlisted and
+/// skipped by keyword scans.
+pub const MODERATION_SESSION_STATUS_UNBANNED: &str = "unbanned";
+
+/// Keyword import source label for plain-text payloads.
+pub const MODERATION_KEYWORD_SOURCE_TXT: &str = "txt";
+/// Keyword import source label for JSON payloads.
+pub const MODERATION_KEYWORD_SOURCE_JSON: &str = "json";
+
+/// One configured moderation keyword.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationKeyword {
+    /// Stable row id.
+    pub id: i64,
+    /// Normalized keyword phrase (lowercased, single-space separated).
+    pub keyword: String,
+    /// Optional reviewer note.
+    pub note: Option<String>,
+    /// Import source: `txt` or `json`.
+    pub source: String,
+    /// Creation timestamp.
+    pub created_at_ms: i64,
+}
+
+/// Insert payload for one moderation keyword.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct NewModerationKeyword {
+    /// Normalized keyword phrase.
+    pub keyword: String,
+    /// Optional reviewer note.
+    pub note: Option<String>,
+    /// Import source: `txt` or `json`.
+    pub source: String,
+    /// Creation timestamp.
+    pub created_at_ms: i64,
+}
+
+/// Outcome of one bulk keyword import.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationKeywordImportOutcome {
+    /// Newly inserted keywords.
+    pub inserted: usize,
+    /// Keywords skipped because they already existed.
+    pub duplicates: usize,
+}
+
+/// Banned-session card without the captured request payload.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationBannedSession {
+    /// Stable row id.
+    pub id: i64,
+    /// Runtime ban key: `provider:key_id:session_id`.
+    pub session_key: String,
+    /// Provider family that produced the ban (`kiro` or `codex`).
+    pub provider: String,
+    /// Authenticated key id at ban time.
+    pub key_id: String,
+    /// Authenticated key display name at ban time.
+    pub key_name: String,
+    /// Client session id; empty when no stable session id was available.
+    pub session_id: String,
+    /// Normalized keyword that fired.
+    pub matched_keyword: String,
+    /// Context snippet around the hit from the normalized request text.
+    pub matched_context: String,
+    /// Gateway endpoint that received the blocked request.
+    pub endpoint: String,
+    /// Requested model, if known.
+    pub model: String,
+    /// Client IP at ban time.
+    pub client_ip: String,
+    /// `banned` or `unbanned`.
+    pub status: String,
+    /// Optional reviewer note recorded with the latest review action.
+    pub review_note: Option<String>,
+    /// Ban timestamp.
+    pub banned_at_ms: i64,
+    /// Latest review timestamp, if reviewed.
+    pub reviewed_at_ms: Option<i64>,
+    /// Update timestamp.
+    pub updated_at_ms: i64,
+}
+
+/// Banned-session detail including the captured request payload.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationBannedSessionDetail {
+    /// Session card.
+    pub session: ModerationBannedSession,
+    /// Captured request headers as a JSON object (sensitive values redacted).
+    pub request_headers_json: String,
+    /// Captured full request body JSON.
+    pub request_body_json: String,
+}
+
+/// Insert payload for one new banned session.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct NewModerationBannedSession {
+    /// Runtime ban key: `provider:key_id:session_id`.
+    pub session_key: String,
+    /// Provider family (`kiro` or `codex`).
+    pub provider: String,
+    /// Authenticated key id.
+    pub key_id: String,
+    /// Authenticated key display name.
+    pub key_name: String,
+    /// Client session id; empty when derived from request content.
+    pub session_id: String,
+    /// Normalized keyword that fired.
+    pub matched_keyword: String,
+    /// Context snippet around the hit.
+    pub matched_context: String,
+    /// Gateway endpoint.
+    pub endpoint: String,
+    /// Requested model, if known.
+    pub model: String,
+    /// Client IP.
+    pub client_ip: String,
+    /// Captured request headers JSON object (sensitive values redacted).
+    pub request_headers_json: String,
+    /// Captured full request body JSON.
+    pub request_body_json: String,
+    /// Ban timestamp.
+    pub banned_at_ms: i64,
+}
+
+/// One page of banned sessions.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationBannedSessionsPage {
+    /// Page rows.
+    pub sessions: Vec<ModerationBannedSession>,
+    /// Total rows matching the filter before pagination.
+    pub total: usize,
+    /// Page limit.
+    pub limit: usize,
+    /// Page offset.
+    pub offset: usize,
+    /// Whether another page is available.
+    pub has_more: bool,
+}
+
+/// Compact startup/refresh snapshot for the in-memory moderation gate.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationRuntimeSnapshot {
+    /// All configured keywords.
+    pub keywords: Vec<ModerationKeyword>,
+    /// Session keys with `banned` status.
+    pub banned_session_keys: Vec<String>,
+    /// Session keys with `unbanned` status (reviewer allowlist).
+    pub allowed_session_keys: Vec<String>,
+}
diff --git a/crates/llm-access-core/src/store/traits.rs b/crates/llm-access-core/src/store/traits.rs
index 96e5e3b9..ae459873 100644
--- a/crates/llm-access-core/src/store/traits.rs
+++ b/crates/llm-access-core/src/store/traits.rs
@@ -33,6 +33,11 @@ use super::{
         AdminKiroBalanceView, AdminKiroStatusCacheUpdate, KiroStatusRefreshTarget,
         NewAdminKiroAccount,
     },
+    moderation::{
+        ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
+        ModerationKeyword, ModerationKeywordImportOutcome, ModerationRuntimeSnapshot,
+        NewModerationBannedSession, NewModerationKeyword,
+    },
     proxy::{
         AdminProxyBinding, AdminProxyConfig, AdminProxyConfigPatch, AdminProxyEndpointCheckUpdate,
         AdminProxyTrafficSnapshot, NewAdminProxyConfig,
@@ -279,6 +284,58 @@ pub trait AdminAnthropicUpstreamStore: Send + Sync {
     }
 }
 
+/// Keyword moderation queries used by the request hot path (startup snapshot,
+/// new ban records) and the admin review surface.
+#[async_trait]
+pub trait AdminModerationStore: Send + Sync {
+    /// Load the compact runtime snapshot consumed by the in-memory gate:
+    /// all keywords plus banned/allowlisted session keys.
+    async fn load_moderation_runtime_snapshot(&self) -> anyhow::Result<ModerationRuntimeSnapshot>;
+
+    /// List all configured moderation keywords.
+    async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>>;
+
+    /// Insert keywords in bulk, skipping ones that already exist.
+    async fn add_moderation_keywords(
+        &self,
+        keywords: Vec<NewModerationKeyword>,
+    ) -> anyhow::Result<ModerationKeywordImportOutcome>;
+
+    /// Delete one keyword by id. Returns the deleted keyword when found.
+    async fn delete_moderation_keyword(&self, id: i64)
+        -> anyhow::Result<Option<ModerationKeyword>>;
+
+    /// Persist one new banned session with its captured request payload.
+    /// Returns `false` when the session key was already recorded.
+    async fn record_moderation_banned_session(
+        &self,
+        record: NewModerationBannedSession,
+    ) -> anyhow::Result<bool>;
+
+    /// List one page of banned sessions, optionally filtered by status.
+    async fn list_moderation_banned_sessions(
+        &self,
+        page: AdminPageRequest,
+        status: Option<&str>,
+    ) -> anyhow::Result<ModerationBannedSessionsPage>;
+
+    /// Load one banned session including the captured request payload.
+    async fn get_moderation_banned_session(
+        &self,
+        id: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSessionDetail>>;
+
+    /// Set the review status (`banned`/`unbanned`) for one session record.
+    /// Returns the updated card when found.
+    async fn set_moderation_banned_session_status(
+        &self,
+        id: i64,
+        status: &str,
+        review_note: Option<&str>,
+        reviewed_at_ms: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSession>>;
+}
+
 /// Public read-only queries used by unauthenticated public endpoints.
 #[async_trait]
 pub trait PublicAccessStore: Send + Sync {
diff --git a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
new file mode 100644
index 00000000..3564ffa9
--- /dev/null
+++ b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
@@ -0,0 +1,34 @@
+CREATE TABLE IF NOT EXISTS llm_moderation_keywords (
+    id BIGSERIAL PRIMARY KEY,
+    keyword TEXT NOT NULL UNIQUE CHECK (length(keyword) > 0),
+    note TEXT,
+    source TEXT NOT NULL DEFAULT 'txt' CHECK (source IN ('txt', 'json')),
+    created_at_ms BIGINT NOT NULL CHECK (created_at_ms >= 0)
+);
+
+CREATE TABLE IF NOT EXISTS llm_moderation_banned_sessions (
+    id BIGSERIAL PRIMARY KEY,
+    session_key TEXT NOT NULL UNIQUE CHECK (length(session_key) > 0),
+    provider TEXT NOT NULL,
+    key_id TEXT NOT NULL,
+    key_name TEXT NOT NULL DEFAULT '',
+    session_id TEXT NOT NULL DEFAULT '',
+    matched_keyword TEXT NOT NULL,
+    matched_context TEXT NOT NULL DEFAULT '',
+    endpoint TEXT NOT NULL DEFAULT '',
+    model TEXT NOT NULL DEFAULT '',
+    client_ip TEXT NOT NULL DEFAULT '',
+    request_headers_json JSONB NOT NULL DEFAULT '{}'::jsonb,
+    request_body_json JSONB NOT NULL DEFAULT 'null'::jsonb,
+    status TEXT NOT NULL DEFAULT 'banned' CHECK (status IN ('banned', 'unbanned')),
+    review_note TEXT,
+    banned_at_ms BIGINT NOT NULL CHECK (banned_at_ms >= 0),
+    reviewed_at_ms BIGINT,
+    updated_at_ms BIGINT NOT NULL CHECK (updated_at_ms >= 0)
+);
+
+CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_status_banned_at
+    ON llm_moderation_banned_sessions(status, banned_at_ms DESC);
+
+CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_key_id
+    ON llm_moderation_banned_sessions(key_id, banned_at_ms DESC);
diff --git a/crates/llm-access-migrations/src/lib.rs b/crates/llm-access-migrations/src/lib.rs
index 48747fd1..611e3dbb 100644
--- a/crates/llm-access-migrations/src/lib.rs
+++ b/crates/llm-access-migrations/src/lib.rs
@@ -183,6 +183,11 @@ const POSTGRES_MIGRATIONS: &[SqlMigration] = &[
         name: "kiro_model_group_preferences",
         sql: include_str!("../migrations/postgres/0035_kiro_model_group_preferences.sql"),
     },
+    SqlMigration {
+        version: 36,
+        name: "keyword_moderation",
+        sql: include_str!("../migrations/postgres/0036_keyword_moderation.sql"),
+    },
 ];
 
 /// Return target DuckDB migrations in execution order.
diff --git a/crates/llm-access-store/src/postgres.rs b/crates/llm-access-store/src/postgres.rs
index 5abaf2bd..f30ee9fa 100644
--- a/crates/llm-access-store/src/postgres.rs
+++ b/crates/llm-access-store/src/postgres.rs
@@ -38,6 +38,7 @@ mod groups;
 mod json;
 mod keys;
 mod kiro_account;
+mod moderation;
 mod proxy;
 mod proxy_support;
 mod public;
diff --git a/crates/llm-access-store/src/postgres/moderation.rs b/crates/llm-access-store/src/postgres/moderation.rs
new file mode 100644
index 00000000..9ddac822
--- /dev/null
+++ b/crates/llm-access-store/src/postgres/moderation.rs
@@ -0,0 +1,335 @@
+//! Keyword moderation store: configured keywords plus banned sessions with
+//! their captured request payloads.
+
+use anyhow::Context;
+use async_trait::async_trait;
+use llm_access_core::store::{
+    AdminModerationStore, AdminPageRequest, ModerationBannedSession, ModerationBannedSessionDetail,
+    ModerationBannedSessionsPage, ModerationKeyword, ModerationKeywordImportOutcome,
+    ModerationRuntimeSnapshot, NewModerationBannedSession, NewModerationKeyword,
+    MODERATION_SESSION_STATUS_BANNED, MODERATION_SESSION_STATUS_UNBANNED,
+};
+
+use super::{now_ms, PgRow, PostgresControlRepository};
+
+const MODERATION_KEYWORD_COLUMNS: &str = "id, keyword, note, source, created_at_ms";
+
+const MODERATION_BANNED_SESSION_COLUMNS: &str =
+    "id, session_key, provider, key_id, key_name, session_id, matched_keyword, matched_context, \
+     endpoint, model, client_ip, status, review_note, banned_at_ms, reviewed_at_ms, updated_at_ms";
+
+fn moderation_keyword_from_row(row: &PgRow) -> ModerationKeyword {
+    ModerationKeyword {
+        id: row.get(0),
+        keyword: row.get(1),
+        note: row.get(2),
+        source: row.get(3),
+        created_at_ms: row.get(4),
+    }
+}
+
+fn moderation_banned_session_from_row(row: &PgRow) -> ModerationBannedSession {
+    ModerationBannedSession {
+        id: row.get(0),
+        session_key: row.get(1),
+        provider: row.get(2),
+        key_id: row.get(3),
+        key_name: row.get(4),
+        session_id: row.get(5),
+        matched_keyword: row.get(6),
+        matched_context: row.get(7),
+        endpoint: row.get(8),
+        model: row.get(9),
+        client_ip: row.get(10),
+        status: row.get(11),
+        review_note: row.get(12),
+        banned_at_ms: row.get(13),
+        reviewed_at_ms: row.get(14),
+        updated_at_ms: row.get(15),
+    }
+}
+
+fn normalized_session_status_filter(status: Option<&str>) -> anyhow::Result<Option<&str>> {
+    match status.map(str::trim).filter(|value| !value.is_empty()) {
+        None => Ok(None),
+        Some(MODERATION_SESSION_STATUS_BANNED) => Ok(Some(MODERATION_SESSION_STATUS_BANNED)),
+        Some(MODERATION_SESSION_STATUS_UNBANNED) => Ok(Some(MODERATION_SESSION_STATUS_UNBANNED)),
+        Some(other) => anyhow::bail!("unsupported moderation session status filter `{other}`"),
+    }
+}
+
+#[async_trait]
+impl AdminModerationStore for PostgresControlRepository {
+    async fn load_moderation_runtime_snapshot(&self) -> anyhow::Result<ModerationRuntimeSnapshot> {
+        self.ensure_connection_alive()?;
+        let keywords = self.list_moderation_keywords().await?;
+        let rows = self
+            .client
+            .query("SELECT session_key, status FROM llm_moderation_banned_sessions", &[])
+            .await
+            .context("load postgres moderation banned session keys")?;
+        let mut banned_session_keys = Vec::new();
+        let mut allowed_session_keys = Vec::new();
+        for row in rows {
+            let session_key: String = row.get(0);
+            let status: String = row.get(1);
+            if status == MODERATION_SESSION_STATUS_UNBANNED {
+                allowed_session_keys.push(session_key);
+            } else {
+                banned_session_keys.push(session_key);
+            }
+        }
+        Ok(ModerationRuntimeSnapshot {
+            keywords,
+            banned_session_keys,
+            allowed_session_keys,
+        })
+    }
+
+    async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>> {
+        self.ensure_connection_alive()?;
+        let sql = format!(
+            "SELECT {MODERATION_KEYWORD_COLUMNS} FROM llm_moderation_keywords ORDER BY id DESC"
+        );
+        let rows = self
+            .client
+            .query(&sql, &[])
+            .await
+            .context("list postgres moderation keywords")?;
+        Ok(rows.iter().map(moderation_keyword_from_row).collect())
+    }
+
+    async fn add_moderation_keywords(
+        &self,
+        keywords: Vec<NewModerationKeyword>,
+    ) -> anyhow::Result<ModerationKeywordImportOutcome> {
+        self.ensure_connection_alive()?;
+        if keywords.is_empty() {
+            return Ok(ModerationKeywordImportOutcome::default());
+        }
+        let total = keywords.len();
+        let mut keyword_values = Vec::with_capacity(total);
+        let mut note_values = Vec::with_capacity(total);
+        let mut source_values = Vec::with_capacity(total);
+        let mut created_at_values = Vec::with_capacity(total);
+        for keyword in keywords {
+            keyword_values.push(keyword.keyword);
+            note_values.push(keyword.note.unwrap_or_default());
+            source_values.push(keyword.source);
+            created_at_values.push(keyword.created_at_ms);
+        }
+        let inserted = self
+            .client
+            .execute(
+                "INSERT INTO llm_moderation_keywords (keyword, note, source, created_at_ms)
+                 SELECT keyword, NULLIF(note, ''), source, created_at_ms
+                 FROM UNNEST($1::text[], $2::text[], $3::text[], $4::bigint[])
+                     AS input(keyword, note, source, created_at_ms)
+                 ON CONFLICT (keyword) DO NOTHING",
+                &[&keyword_values, &note_values, &source_values, &created_at_values],
+            )
+            .await
+            .context("insert postgres moderation keywords")? as usize;
+        Ok(ModerationKeywordImportOutcome {
+            inserted,
+            duplicates: total.saturating_sub(inserted),
+        })
+    }
+
+    async fn delete_moderation_keyword(
+        &self,
+        id: i64,
+    ) -> anyhow::Result<Option<ModerationKeyword>> {
+        self.ensure_connection_alive()?;
+        let sql = format!(
+            "DELETE FROM llm_moderation_keywords WHERE id = $1
+             RETURNING {MODERATION_KEYWORD_COLUMNS}"
+        );
+        let row = self
+            .client
+            .query_opt(&sql, &[&id])
+            .await
+            .context("delete postgres moderation keyword")?;
+        Ok(row.as_ref().map(moderation_keyword_from_row))
+    }
+
+    async fn record_moderation_banned_session(
+        &self,
+        record: NewModerationBannedSession,
+    ) -> anyhow::Result<bool> {
+        self.ensure_connection_alive()?;
+        let inserted = self
+            .client
+            .execute(
+                "INSERT INTO llm_moderation_banned_sessions (
+                    session_key,
+                    provider,
+                    key_id,
+                    key_name,
+                    session_id,
+                    matched_keyword,
+                    matched_context,
+                    endpoint,
+                    model,
+                    client_ip,
+                    request_headers_json,
+                    request_body_json,
+                    status,
+                    banned_at_ms,
+                    updated_at_ms
+                 )
+                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11::jsonb, $12::jsonb,
+                         'banned', $13, $13)
+                 ON CONFLICT (session_key) DO NOTHING",
+                &[
+                    &record.session_key,
+                    &record.provider,
+                    &record.key_id,
+                    &record.key_name,
+                    &record.session_id,
+                    &record.matched_keyword,
+                    &record.matched_context,
+                    &record.endpoint,
+                    &record.model,
+                    &record.client_ip,
+                    &record.request_headers_json,
+                    &record.request_body_json,
+                    &record.banned_at_ms,
+                ],
+            )
+            .await
+            .context("record postgres moderation banned session")?;
+        Ok(inserted > 0)
+    }
+
+    async fn list_moderation_banned_sessions(
+        &self,
+        page: AdminPageRequest,
+        status: Option<&str>,
+    ) -> anyhow::Result<ModerationBannedSessionsPage> {
+        self.ensure_connection_alive()?;
+        let status = normalized_session_status_filter(status)?;
+        let limit = page.limit.max(1);
+        let limit_i64 = limit.min(i64::MAX as usize) as i64;
+        let offset_i64 = page.offset.min(i64::MAX as usize) as i64;
+        let (total, rows) = match status {
+            Some(status) => {
+                let total: i64 = self
+                    .client
+                    .query_one(
+                        "SELECT COUNT(*) FROM llm_moderation_banned_sessions WHERE status = $1",
+                        &[&status],
+                    )
+                    .await
+                    .context("count postgres moderation banned sessions")?
+                    .get(0);
+                let sql = format!(
+                    "SELECT {MODERATION_BANNED_SESSION_COLUMNS}
+                     FROM llm_moderation_banned_sessions
+                     WHERE status = $1
+                     ORDER BY banned_at_ms DESC, id DESC
+                     LIMIT $2 OFFSET $3"
+                );
+                let rows = self
+                    .client
+                    .query(&sql, &[&status, &limit_i64, &offset_i64])
+                    .await
+                    .context("list postgres moderation banned sessions")?;
+                (total, rows)
+            },
+            None => {
+                let total: i64 = self
+                    .client
+                    .query_one("SELECT COUNT(*) FROM llm_moderation_banned_sessions", &[])
+                    .await
+                    .context("count postgres moderation banned sessions")?
+                    .get(0);
+                let sql = format!(
+                    "SELECT {MODERATION_BANNED_SESSION_COLUMNS}
+                     FROM llm_moderation_banned_sessions
+                     ORDER BY banned_at_ms DESC, id DESC
+                     LIMIT $1 OFFSET $2"
+                );
+                let rows = self
+                    .client
+                    .query(&sql, &[&limit_i64, &offset_i64])
+                    .await
+                    .context("list postgres moderation banned sessions")?;
+                (total, rows)
+            },
+        };
+        let sessions: Vec<ModerationBannedSession> = rows
+            .iter()
+            .map(moderation_banned_session_from_row)
+            .collect();
+        let total = total.max(0) as usize;
+        Ok(ModerationBannedSessionsPage {
+            has_more: page.offset.saturating_add(sessions.len()) < total,
+            sessions,
+            total,
+            limit,
+            offset: page.offset,
+        })
+    }
+
+    async fn get_moderation_banned_session(
+        &self,
+        id: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSessionDetail>> {
+        self.ensure_connection_alive()?;
+        let sql = format!(
+            "SELECT {MODERATION_BANNED_SESSION_COLUMNS},
+                    request_headers_json::text,
+                    request_body_json::text
+             FROM llm_moderation_banned_sessions
+             WHERE id = $1"
+        );
+        let Some(row) = self
+            .client
+            .query_opt(&sql, &[&id])
+            .await
+            .context("load postgres moderation banned session")?
+        else {
+            return Ok(None);
+        };
+        Ok(Some(ModerationBannedSessionDetail {
+            session: moderation_banned_session_from_row(&row),
+            request_headers_json: row.get(16),
+            request_body_json: row.get(17),
+        }))
+    }
+
+    async fn set_moderation_banned_session_status(
+        &self,
+        id: i64,
+        status: &str,
+        review_note: Option<&str>,
+        reviewed_at_ms: i64,
+    ) -> anyhow::Result<Option<ModerationBannedSession>> {
+        self.ensure_connection_alive()?;
+        if status != MODERATION_SESSION_STATUS_BANNED
+            && status != MODERATION_SESSION_STATUS_UNBANNED
+        {
+            anyhow::bail!("unsupported moderation session status `{status}`");
+        }
+        let review_note = review_note
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(str::to_string);
+        let sql = format!(
+            "UPDATE llm_moderation_banned_sessions
+             SET status = $2,
+                 review_note = COALESCE($3, review_note),
+                 reviewed_at_ms = $4,
+                 updated_at_ms = $5
+             WHERE id = $1
+             RETURNING {MODERATION_BANNED_SESSION_COLUMNS}"
+        );
+        let row = self
+            .client
+            .query_opt(&sql, &[&id, &status, &review_note, &reviewed_at_ms, &now_ms()])
+            .await
+            .context("update postgres moderation banned session status")?;
+        Ok(row.as_ref().map(moderation_banned_session_from_row))
+    }
+}
diff --git a/crates/llm-access/src/admin.rs b/crates/llm-access/src/admin.rs
index 883739f4..6aac0d5f 100644
--- a/crates/llm-access/src/admin.rs
+++ b/crates/llm-access/src/admin.rs
@@ -21,6 +21,7 @@ use llm_access_anthropic_pool::is_private_or_loopback_ip;
 #[cfg(any(feature = "duckdb-runtime", feature = "duckdb-bundled"))]
 use llm_access_core::store::UsageEventSink;
 use llm_access_core::{
+    moderation as core_moderation,
     provider::{ProtocolFamily, ProviderType, RouteStrategy},
     store::{
         self as core_store, AdminAccountContributionRequest, AdminAccountGroupPatch,
@@ -3076,6 +3077,270 @@ pub(crate) async fn test_admin_anthropic_upstream_model(
     }
 }
 
+#[derive(Debug, Serialize)]
+struct AdminModerationKeywordsResponse {
+    keywords: Vec<core_store::ModerationKeyword>,
+    total: usize,
+    stats: crate::moderation::ModerationGateStats,
+    generated_at: i64,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct AddAdminModerationKeywordsRequest {
+    /// Raw payload to parse. When `format` is `json` it must be valid keyword
+    /// JSON; otherwise it is parsed line-by-line as plain text.
+    content: String,
+    /// `txt` (default) or `json`.
+    #[serde(default)]
+    format: Option<String>,
+    /// Optional shared note applied to every imported keyword.
+    #[serde(default)]
+    note: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+struct AddAdminModerationKeywordsResponse {
+    inserted: usize,
+    duplicates: usize,
+    parsed: usize,
+    generated_at: i64,
+}
+
+#[derive(Debug, Serialize)]
+struct AdminModerationBannedSessionsResponse {
+    sessions: Vec<core_store::ModerationBannedSession>,
+    total: usize,
+    limit: usize,
+    offset: usize,
+    has_more: bool,
+    generated_at: i64,
+}
+
+#[derive(Debug, Deserialize, Default)]
+pub(crate) struct AdminModerationBannedSessionsQuery {
+    limit: Option<usize>,
+    offset: Option<usize>,
+    status: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct ReviewAdminModerationBannedSessionRequest {
+    /// `true` keeps the ban, `false` unbans (allowlists) the session.
+    banned: bool,
+    #[serde(default)]
+    review_note: Option<String>,
+}
+
+pub(crate) async fn list_admin_moderation_keywords(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .list_moderation_keywords()
+        .await
+    {
+        Ok(keywords) => Json(AdminModerationKeywordsResponse {
+            total: keywords.len(),
+            keywords,
+            stats: state.moderation_gate.stats(),
+            generated_at: now_ms(),
+        })
+        .into_response(),
+        Err(_) => internal_error("Failed to list moderation keywords").into_response(),
+    }
+}
+
+pub(crate) async fn add_admin_moderation_keywords(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Json(request): Json<AddAdminModerationKeywordsRequest>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    let format = request
+        .format
+        .as_deref()
+        .map(str::trim)
+        .map(str::to_ascii_lowercase)
+        .unwrap_or_else(|| core_store::MODERATION_KEYWORD_SOURCE_TXT.to_string());
+    let (source, parsed) = match format.as_str() {
+        core_store::MODERATION_KEYWORD_SOURCE_JSON => {
+            match core_moderation::parse_moderation_keywords_json(&request.content) {
+                Ok(keywords) => (core_store::MODERATION_KEYWORD_SOURCE_JSON, keywords),
+                Err(err) => return bad_request(&err.to_string()).into_response(),
+            }
+        },
+        core_store::MODERATION_KEYWORD_SOURCE_TXT | "text" | "" => (
+            core_store::MODERATION_KEYWORD_SOURCE_TXT,
+            core_moderation::parse_moderation_keywords_txt(&request.content),
+        ),
+        other => {
+            return bad_request(&format!("unsupported keyword format `{other}`")).into_response()
+        },
+    };
+    if parsed.is_empty() {
+        return bad_request("no keywords were parsed from the payload").into_response();
+    }
+    let note = request
+        .note
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(str::to_string);
+    let parsed_count = parsed.len();
+    let created_at_ms = now_ms();
+    let records: Vec<core_store::NewModerationKeyword> = parsed
+        .into_iter()
+        .map(|keyword| core_store::NewModerationKeyword {
+            keyword,
+            note: note.clone(),
+            source: source.to_string(),
+            created_at_ms,
+        })
+        .collect();
+    match state
+        .admin_moderation_store
+        .add_moderation_keywords(records)
+        .await
+    {
+        Ok(outcome) => {
+            reload_moderation_gate(&state).await;
+            Json(AddAdminModerationKeywordsResponse {
+                inserted: outcome.inserted,
+                duplicates: outcome.duplicates,
+                parsed: parsed_count,
+                generated_at: now_ms(),
+            })
+            .into_response()
+        },
+        Err(_) => internal_error("Failed to import moderation keywords").into_response(),
+    }
+}
+
+pub(crate) async fn delete_admin_moderation_keyword(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .delete_moderation_keyword(id)
+        .await
+    {
+        Ok(Some(keyword)) => {
+            reload_moderation_gate(&state).await;
+            Json(DeleteResponse {
+                deleted: true,
+                id: keyword.id.to_string(),
+            })
+            .into_response()
+        },
+        Ok(None) => not_found("Moderation keyword not found").into_response(),
+        Err(_) => internal_error("Failed to delete moderation keyword").into_response(),
+    }
+}
+
+pub(crate) async fn list_admin_moderation_banned_sessions(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Query(query): Query<AdminModerationBannedSessionsQuery>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    let page_request = core_store::AdminPageRequest {
+        limit: query
+            .limit
+            .unwrap_or(DEFAULT_ADMIN_LIST_LIMIT)
+            .clamp(1, MAX_ADMIN_LIST_LIMIT),
+        offset: query.offset.unwrap_or(0),
+    };
+    let status = query
+        .status
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty() && *value != "all");
+    match state
+        .admin_moderation_store
+        .list_moderation_banned_sessions(page_request, status)
+        .await
+    {
+        Ok(page) => Json(AdminModerationBannedSessionsResponse {
+            sessions: page.sessions,
+            total: page.total,
+            limit: page.limit,
+            offset: page.offset,
+            has_more: page.has_more,
+            generated_at: now_ms(),
+        })
+        .into_response(),
+        Err(_) => internal_error("Failed to list banned sessions").into_response(),
+    }
+}
+
+pub(crate) async fn get_admin_moderation_banned_session(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .get_moderation_banned_session(id)
+        .await
+    {
+        Ok(Some(detail)) => Json(detail).into_response(),
+        Ok(None) => not_found("Banned session not found").into_response(),
+        Err(_) => internal_error("Failed to load banned session").into_response(),
+    }
+}
+
+pub(crate) async fn review_admin_moderation_banned_session(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+    Json(request): Json<ReviewAdminModerationBannedSessionRequest>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    let status = if request.banned {
+        core_store::MODERATION_SESSION_STATUS_BANNED
+    } else {
+        core_store::MODERATION_SESSION_STATUS_UNBANNED
+    };
+    match state
+        .admin_moderation_store
+        .set_moderation_banned_session_status(id, status, request.review_note.as_deref(), now_ms())
+        .await
+    {
+        Ok(Some(session)) => {
+            state
+                .moderation_gate
+                .apply_review(&session.session_key, request.banned);
+            Json(session).into_response()
+        },
+        Ok(None) => not_found("Banned session not found").into_response(),
+        Err(_) => internal_error("Failed to review banned session").into_response(),
+    }
+}
+
+async fn reload_moderation_gate(state: &HttpState) {
+    if let Err(err) = state.moderation_gate.reload().await {
+        tracing::warn!("failed to reload moderation gate after admin change: {err:#}");
+    }
+}
+
 pub(crate) fn kiro_cache_simulation_config_from_admin_config(
     config: &AdminRuntimeConfig,
 ) -> KiroCacheSimulationConfig {
diff --git a/crates/llm-access/src/lib.rs b/crates/llm-access/src/lib.rs
index dd279374..ab2e53ef 100644
--- a/crates/llm-access/src/lib.rs
+++ b/crates/llm-access/src/lib.rs
@@ -19,6 +19,8 @@ mod kiro_headers;
 mod kiro_latency;
 mod kiro_refresh;
 mod kiro_status;
+/// Keyword moderation gate.
+pub mod moderation;
 mod process_memory;
 /// Provider request entrypoints.
 pub mod provider;
@@ -63,10 +65,11 @@ use llm_access_codex_image::{
 };
 use llm_access_core::store::{
     AdminAccountGroupStore, AdminAnthropicUpstreamStore, AdminCodexAccountStore, AdminConfigStore,
-    AdminKeyStore, AdminKiroAccountStore, AdminProxyStore, AdminReviewQueueStore,
-    PublicAccessStore, PublicCommunityStore, PublicStatusStore, PublicSubmissionStore,
-    PublicUsageStore,
+    AdminKeyStore, AdminKiroAccountStore, AdminModerationStore, AdminProxyStore,
+    AdminReviewQueueStore, PublicAccessStore, PublicCommunityStore, PublicStatusStore,
+    PublicSubmissionStore, PublicUsageStore,
 };
+use moderation::ModerationGate;
 use serde::Serialize;
 use tokio::sync::Semaphore;
 use tower_http::cors::{Any, CorsLayer};
@@ -91,6 +94,8 @@ struct HttpState {
     admin_codex_account_store: Arc<dyn AdminCodexAccountStore>,
     admin_kiro_account_store: Arc<dyn AdminKiroAccountStore>,
     admin_anthropic_upstream_store: Arc<dyn AdminAnthropicUpstreamStore>,
+    admin_moderation_store: Arc<dyn AdminModerationStore>,
+    moderation_gate: Arc<ModerationGate>,
     admin_review_queue_store: Arc<dyn AdminReviewQueueStore>,
     public_access_store: Arc<dyn PublicAccessStore>,
     public_community_store: Arc<dyn PublicCommunityStore>,
@@ -196,7 +201,7 @@ pub fn router_with_simulator(
 ) -> (Router, Arc<llm_access_kiro::cache_sim::KiroCacheSimulator>) {
     let request_activity = Arc::new(activity::RequestActivityTracker::new());
     let geoip = runtime.geoip();
-    let provider_state = provider::ProviderState::new_with_config_store_activity_and_latency(
+    let mut provider_state = provider::ProviderState::new_with_config_store_activity_and_latency(
         runtime.control_store(),
         runtime.provider_route_store(),
         runtime.admin_config_store(),
@@ -204,6 +209,11 @@ pub fn router_with_simulator(
         geoip.clone(),
         runtime.kiro_latency_ranker(),
     );
+    let moderation_gate = ModerationGate::new(runtime.admin_moderation_store());
+    provider_state.set_moderation_gate(Arc::clone(&moderation_gate));
+    if let Ok(handle) = tokio::runtime::Handle::try_current() {
+        handle.spawn(Arc::clone(&moderation_gate).run_refresh_loop());
+    }
     let codex_image_gateway = Arc::new(
         CodexImageGateway::new(CodexImageGatewayConfig {
             mode: ImageGatewayMode::IntegratedCodexApi,
@@ -230,6 +240,8 @@ pub fn router_with_simulator(
         admin_codex_account_store: runtime.admin_codex_account_store(),
         admin_kiro_account_store: runtime.admin_kiro_account_store(),
         admin_anthropic_upstream_store: runtime.admin_anthropic_upstream_store(),
+        admin_moderation_store: runtime.admin_moderation_store(),
+        moderation_gate,
         admin_review_queue_store: runtime.admin_review_queue_store(),
         public_access_store: runtime.public_access_store(),
         public_community_store: runtime.public_community_store(),
@@ -434,6 +446,26 @@ pub fn router_with_simulator(
             "/admin/kiro-gateway/anthropic-upstreams/:name/test",
             post(admin::test_admin_anthropic_upstream_model),
         )
+        .route(
+            "/admin/llm-gateway/moderation/keywords",
+            get(admin::list_admin_moderation_keywords).post(admin::add_admin_moderation_keywords),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/keywords/:id",
+            delete(admin::delete_admin_moderation_keyword),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/banned-sessions",
+            get(admin::list_admin_moderation_banned_sessions),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/banned-sessions/:id",
+            get(admin::get_admin_moderation_banned_session),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/banned-sessions/:id/review",
+            post(admin::review_admin_moderation_banned_session),
+        )
         .route(
             "/admin/kiro-gateway/accounts",
             get(admin::list_admin_kiro_accounts).post(admin::create_admin_kiro_manual_account),
diff --git a/crates/llm-access/src/moderation.rs b/crates/llm-access/src/moderation.rs
new file mode 100644
index 00000000..d37b393d
--- /dev/null
+++ b/crates/llm-access/src/moderation.rs
@@ -0,0 +1,450 @@
+//! In-memory keyword moderation gate enforced before upstream dispatch.
+//!
+//! The gate keeps everything the hot path needs in process memory — the
+//! compiled keyword automaton plus banned/allowlisted session key sets — so
+//! request-time checks never touch Postgres. Postgres is written exactly once
+//! per newly banned session (capturing the full request body and headers for
+//! review) and read only on startup, periodic refresh, and admin mutations.
+
+use std::{
+    collections::HashSet,
+    sync::{
+        atomic::{AtomicU64, Ordering},
+        Arc, RwLock,
+    },
+    time::Duration,
+};
+
+use axum::http::HeaderMap;
+use llm_access_core::{
+    moderation::{extract_moderation_text, normalize_moderation_text, ModerationMatcher},
+    store::{AdminModerationStore, EmptyAdminModerationStore, NewModerationBannedSession},
+};
+use llm_access_kiro::anthropic::types::MessagesRequest;
+use serde::Serialize;
+use sha2::{Digest, Sha256};
+
+/// Provider label recorded for Kiro-surface bans (native and direct Anthropic
+/// upstream dispatch).
+pub(crate) const MODERATION_PROVIDER_KIRO: &str = "kiro";
+/// Provider label recorded for Codex-surface bans.
+pub(crate) const MODERATION_PROVIDER_CODEX: &str = "codex";
+
+/// Client-facing rejection message for moderated sessions.
+pub(crate) const MODERATION_BLOCKED_MESSAGE: &str = "This session has been blocked by the gateway \
+                                                     content policy. Contact the administrator if \
+                                                     you believe this is a mistake.";
+
+const MODERATION_REFRESH_INTERVAL_ENV: &str = "LLM_ACCESS_MODERATION_REFRESH_SECONDS";
+const DEFAULT_MODERATION_REFRESH_INTERVAL: Duration = Duration::from_secs(300);
+
+/// Header names whose values are redacted before a ban record is persisted.
+const REDACTED_HEADER_NAMES: [&str; 5] =
+    ["authorization", "proxy-authorization", "x-api-key", "x-admin-token", "cookie"];
+
+/// Hot-path decision for one request before any keyword scan runs.
+pub(crate) enum ModerationPrecheck {
+    /// Session key is already banned: reject without scanning or writing.
+    Blocked,
+    /// Session key was cleared by a reviewer, or the gate has no keywords /
+    /// no loaded snapshot yet: skip scanning entirely.
+    Skip,
+    /// Scan the request text with the compiled automaton.
+    Scan(Arc<ModerationMatcher>),
+}
+
+#[derive(Default)]
+struct ModerationGateState {
+    matcher: Option<Arc<ModerationMatcher>>,
+    keyword_count: usize,
+    banned: HashSet<String>,
+    allowed: HashSet<String>,
+    loaded: bool,
+    loaded_at_ms: Option<i64>,
+}
+
+/// Runtime counters and cache sizes surfaced on the admin overview.
+#[derive(Debug, Clone, Serialize)]
+pub(crate) struct ModerationGateStats {
+    pub loaded: bool,
+    pub loaded_at_ms: Option<i64>,
+    pub keyword_count: usize,
+    pub banned_session_count: usize,
+    pub allowed_session_count: usize,
+    pub blocked_requests_total: u64,
+    pub persist_failures_total: u64,
+}
+
+/// Shared keyword moderation gate. See module docs for the caching contract.
+pub struct ModerationGate {
+    store: Arc<dyn AdminModerationStore>,
+    state: RwLock<ModerationGateState>,
+    blocked_requests_total: AtomicU64,
+    persist_failures_total: Arc<AtomicU64>,
+}
+
+impl ModerationGate {
+    /// Create a gate backed by a persistent moderation store. The gate starts
+    /// unloaded (fail-open) until the first [`Self::reload`] succeeds.
+    pub fn new(store: Arc<dyn AdminModerationStore>) -> Arc<Self> {
+        Arc::new(Self {
+            store,
+            state: RwLock::new(ModerationGateState::default()),
+            blocked_requests_total: AtomicU64::new(0),
+            persist_failures_total: Arc::new(AtomicU64::new(0)),
+        })
+    }
+
+    /// Create a permanently empty gate for tests and store-less runtimes.
+    pub fn disabled() -> Arc<Self> {
+        let gate = Self::new(Arc::new(EmptyAdminModerationStore));
+        {
+            let mut state = gate.state.write().expect("moderation gate lock poisoned");
+            state.loaded = true;
+        }
+        gate
+    }
+
+    /// Reload the keyword automaton and session sets from the store.
+    pub async fn reload(&self) -> anyhow::Result<()> {
+        let snapshot = self.store.load_moderation_runtime_snapshot().await?;
+        let matcher = ModerationMatcher::build(
+            snapshot
+                .keywords
+                .iter()
+                .map(|keyword| keyword.keyword.as_str()),
+        )?
+        .map(Arc::new);
+        let keyword_count = matcher
+            .as_ref()
+            .map(|matcher| matcher.pattern_count())
+            .unwrap_or(0);
+        let mut state = self.state.write().expect("moderation gate lock poisoned");
+        state.matcher = matcher;
+        state.keyword_count = keyword_count;
+        state.banned = snapshot.banned_session_keys.into_iter().collect();
+        state.allowed = snapshot.allowed_session_keys.into_iter().collect();
+        state.loaded = true;
+        state.loaded_at_ms = Some(now_ms());
+        Ok(())
+    }
+
+    /// Reload immediately, then keep the snapshot fresh on a fixed interval as
+    /// a safety net for out-of-band store changes.
+    pub async fn run_refresh_loop(self: Arc<Self>) {
+        let interval = moderation_refresh_interval();
+        loop {
+            match self.reload().await {
+                Ok(()) => {
+                    let stats = self.stats();
+                    tracing::debug!(
+                        keyword_count = stats.keyword_count,
+                        banned_session_count = stats.banned_session_count,
+                        allowed_session_count = stats.allowed_session_count,
+                        "moderation gate snapshot refreshed"
+                    );
+                },
+                Err(err) => {
+                    tracing::warn!("moderation gate snapshot refresh failed: {err:#}");
+                },
+            }
+            tokio::time::sleep(interval).await;
+        }
+    }
+
+    /// Classify one request before scanning.
+    pub(crate) fn precheck(&self, session_key: Option<&str>) -> ModerationPrecheck {
+        let state = self.state.read().expect("moderation gate lock poisoned");
+        if !state.loaded {
+            return ModerationPrecheck::Skip;
+        }
+        if let Some(session_key) = session_key {
+            if state.banned.contains(session_key) {
+                return ModerationPrecheck::Blocked;
+            }
+            if state.allowed.contains(session_key) {
+                return ModerationPrecheck::Skip;
+            }
+        }
+        match &state.matcher {
+            Some(matcher) => ModerationPrecheck::Scan(Arc::clone(matcher)),
+            None => ModerationPrecheck::Skip,
+        }
+    }
+
+    /// Count one rejected request (new ban or repeat block).
+    pub(crate) fn note_blocked_request(&self) {
+        self.blocked_requests_total.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Ban a session in memory and persist the capture exactly once. Repeat
+    /// calls for an already-banned session key never reach the store.
+    pub(crate) fn ban_session(&self, record: NewModerationBannedSession) {
+        let newly_banned = {
+            let mut state = self.state.write().expect("moderation gate lock poisoned");
+            state.state_ban(&record.session_key)
+        };
+        if !newly_banned {
+            return;
+        }
+        tracing::warn!(
+            session_key = %record.session_key,
+            provider = %record.provider,
+            key_id = %record.key_id,
+            matched_keyword = %record.matched_keyword,
+            endpoint = %record.endpoint,
+            "moderation keyword hit banned session"
+        );
+        let store = Arc::clone(&self.store);
+        let persist_failures = Arc::clone(&self.persist_failures_total);
+        tokio::spawn(async move {
+            let session_key = record.session_key.clone();
+            match store.record_moderation_banned_session(record).await {
+                Ok(true) => {},
+                Ok(false) => tracing::debug!(
+                    session_key = %session_key,
+                    "moderation banned session was already recorded"
+                ),
+                Err(err) => {
+                    persist_failures.fetch_add(1, Ordering::Relaxed);
+                    tracing::error!(
+                        session_key = %session_key,
+                        "failed to persist moderation banned session: {err:#}"
+                    );
+                },
+            }
+        });
+    }
+
+    /// Apply a reviewer decision to the in-memory sets without a full reload.
+    pub(crate) fn apply_review(&self, session_key: &str, banned: bool) {
+        let mut state = self.state.write().expect("moderation gate lock poisoned");
+        if banned {
+            state.allowed.remove(session_key);
+            state.banned.insert(session_key.to_string());
+        } else {
+            state.banned.remove(session_key);
+            state.allowed.insert(session_key.to_string());
+        }
+    }
+
+    /// Runtime stats for the admin overview.
+    pub(crate) fn stats(&self) -> ModerationGateStats {
+        let state = self.state.read().expect("moderation gate lock poisoned");
+        ModerationGateStats {
+            loaded: state.loaded,
+            loaded_at_ms: state.loaded_at_ms,
+            keyword_count: state.keyword_count,
+            banned_session_count: state.banned.len(),
+            allowed_session_count: state.allowed.len(),
+            blocked_requests_total: self.blocked_requests_total.load(Ordering::Relaxed),
+            persist_failures_total: self.persist_failures_total.load(Ordering::Relaxed),
+        }
+    }
+}
+
+impl ModerationGateState {
+    fn state_ban(&mut self, session_key: &str) -> bool {
+        self.allowed.remove(session_key);
+        self.banned.insert(session_key.to_string())
+    }
+}
+
+/// Compose the runtime ban key.
+pub(crate) fn moderation_session_key(provider: &str, key_id: &str, session_id: &str) -> String {
+    format!("{provider}:{key_id}:{session_id}")
+}
+
+/// Derive a stable content-scoped ban key for requests without any session id
+/// so identical retries are deduplicated in memory and by the store conflict.
+pub(crate) fn derived_moderation_session_key(provider: &str, key_id: &str, body: &[u8]) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(body);
+    let digest = hasher.finalize();
+    let mut preview = String::with_capacity(16);
+    for byte in digest.iter().take(8) {
+        preview.push_str(&format!("{byte:02x}"));
+    }
+    format!("{provider}:{key_id}:content:{preview}")
+}
+
+/// Serialize request headers to a JSON object with sensitive values redacted.
+pub(crate) fn redacted_headers_json(headers: &HeaderMap) -> String {
+    let mut map = serde_json::Map::new();
+    for name in headers.keys() {
+        let key = name.as_str().to_ascii_lowercase();
+        let values: Vec<serde_json::Value> = headers
+            .get_all(name)
+            .iter()
+            .map(|value| {
+                if REDACTED_HEADER_NAMES.contains(&key.as_str()) {
+                    serde_json::Value::String("<redacted>".to_string())
+                } else {
+                    serde_json::Value::String(value.to_str().unwrap_or("<non-utf8>").to_string())
+                }
+            })
+            .collect();
+        match values.len() {
+            0 => {},
+            1 => {
+                map.insert(key, values.into_iter().next().expect("one header value"));
+            },
+            _ => {
+                map.insert(key, serde_json::Value::Array(values));
+            },
+        }
+    }
+    serde_json::to_string(&serde_json::Value::Object(map)).unwrap_or_else(|_| "{}".to_string())
+}
+
+/// Ensure the captured body is valid JSON for the `jsonb` column; wrap
+/// non-JSON payloads as a JSON string.
+pub(crate) fn moderation_body_json(body: &[u8]) -> String {
+    match serde_json::from_slice::<serde_json::Value>(body) {
+        Ok(_) => String::from_utf8_lossy(body).into_owned(),
+        Err(_) => serde_json::to_string(&String::from_utf8_lossy(body))
+            .unwrap_or_else(|_| "null".to_string()),
+    }
+}
+
+/// Normalized moderation text for a parsed Anthropic messages request.
+pub(crate) fn moderation_text_for_kiro(payload: &MessagesRequest) -> String {
+    let mut collected = String::new();
+    if let Some(system) = &payload.system {
+        for block in system {
+            if !block.text.is_empty() {
+                if !collected.is_empty() {
+                    collected.push('\n');
+                }
+                collected.push_str(&block.text);
+            }
+        }
+    }
+    for message in &payload.messages {
+        match &message.content {
+            serde_json::Value::String(text) => {
+                if !text.is_empty() {
+                    if !collected.is_empty() {
+                        collected.push('\n');
+                    }
+                    collected.push_str(text);
+                }
+            },
+            other => {
+                let extracted = extract_moderation_text(other);
+                if !extracted.is_empty() {
+                    if !collected.is_empty() {
+                        collected.push('\n');
+                    }
+                    collected.push_str(&extracted);
+                }
+            },
+        }
+    }
+    normalize_moderation_text(&collected)
+}
+
+/// Normalized moderation text for a raw JSON request body (Codex surface).
+pub(crate) fn moderation_text_for_json_body(body: &[u8]) -> Option<String> {
+    let value = serde_json::from_slice::<serde_json::Value>(body).ok()?;
+    Some(normalize_moderation_text(&extract_moderation_text(&value)))
+}
+
+fn moderation_refresh_interval() -> Duration {
+    std::env::var(MODERATION_REFRESH_INTERVAL_ENV)
+        .ok()
+        .and_then(|value| value.trim().parse::<u64>().ok())
+        .map(|seconds| Duration::from_secs(seconds.clamp(15, 24 * 60 * 60)))
+        .unwrap_or(DEFAULT_MODERATION_REFRESH_INTERVAL)
+}
+
+fn now_ms() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|duration| duration.as_millis().min(i64::MAX as u128) as i64)
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use axum::http::{HeaderMap, HeaderValue};
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn session_key_uses_provider_key_and_session() {
+        assert_eq!(
+            moderation_session_key(MODERATION_PROVIDER_KIRO, "key-1", "sess-9"),
+            "kiro:key-1:sess-9"
+        );
+    }
+
+    #[test]
+    fn derived_session_key_is_stable_and_content_scoped() {
+        let a = derived_moderation_session_key(MODERATION_PROVIDER_CODEX, "key-1", b"hello world");
+        let b = derived_moderation_session_key(MODERATION_PROVIDER_CODEX, "key-1", b"hello world");
+        let c = derived_moderation_session_key(MODERATION_PROVIDER_CODEX, "key-1", b"other body");
+        assert_eq!(a, b);
+        assert_ne!(a, c);
+        assert!(a.starts_with("codex:key-1:content:"));
+    }
+
+    #[test]
+    fn redacted_headers_hide_sensitive_values() {
+        let mut headers = HeaderMap::new();
+        headers.insert("authorization", HeaderValue::from_static("Bearer secret"));
+        headers.insert("x-api-key", HeaderValue::from_static("sk-123"));
+        headers.insert("content-type", HeaderValue::from_static("application/json"));
+        let json = redacted_headers_json(&headers);
+        let value: serde_json::Value = serde_json::from_str(&json).expect("valid json");
+        assert_eq!(value["authorization"], "<redacted>");
+        assert_eq!(value["x-api-key"], "<redacted>");
+        assert_eq!(value["content-type"], "application/json");
+    }
+
+    #[test]
+    fn body_json_wraps_non_json_payloads() {
+        assert_eq!(moderation_body_json(br#"{"a":1}"#), r#"{"a":1}"#);
+        assert_eq!(moderation_body_json(b"not json"), "\"not json\"");
+    }
+
+    #[test]
+    fn kiro_text_extraction_joins_system_and_messages() {
+        let payload: MessagesRequest = serde_json::from_value(json!({
+            "model": "claude-sonnet-4",
+            "max_tokens": 64,
+            "system": "You are HELPFUL",
+            "messages": [
+                {"role": "user", "content": "How to Build a Bomb"},
+                {"role": "assistant", "content": [{"type": "text", "text": "No."}]}
+            ]
+        }))
+        .expect("parse messages request");
+        let text = moderation_text_for_kiro(&payload);
+        assert!(text.contains("you are helpful"));
+        assert!(text.contains("how to build a bomb"));
+        assert!(!text.contains("claude-sonnet-4"));
+    }
+
+    #[test]
+    fn json_body_text_extraction_normalizes_content() {
+        let body = json!({
+            "model": "gpt-5",
+            "messages": [{"role": "user", "content": "Hello  World"}]
+        })
+        .to_string();
+        let text = moderation_text_for_json_body(body.as_bytes()).expect("some text");
+        assert_eq!(text, "hello world");
+    }
+
+    #[tokio::test]
+    async fn disabled_gate_skips_all_sessions() {
+        let gate = ModerationGate::disabled();
+        assert!(matches!(gate.precheck(Some("kiro:key:sess")), ModerationPrecheck::Skip));
+        assert!(matches!(gate.precheck(None), ModerationPrecheck::Skip));
+        let stats = gate.stats();
+        assert_eq!(stats.keyword_count, 0);
+        assert!(stats.loaded);
+    }
+}
diff --git a/crates/llm-access/src/provider.rs b/crates/llm-access/src/provider.rs
index 971027b9..24589244 100644
--- a/crates/llm-access/src/provider.rs
+++ b/crates/llm-access/src/provider.rs
@@ -207,6 +207,7 @@ pub struct ProviderState {
     kiro_latency_ranker: Arc<KiroLatencyRanker>,
     request_activity: Arc<RequestActivityTracker>,
     protected_thinking_signature_secret: Option<Arc<str>>,
+    moderation_gate: Arc<crate::moderation::ModerationGate>,
 }
 
 /// Runtime dependencies passed from the authenticated provider entrypoint into
@@ -227,6 +228,7 @@ pub struct ProviderDispatchDeps {
     kiro_session_affinity: Arc<KiroSessionAffinity>,
     kiro_latency_ranker: Arc<KiroLatencyRanker>,
     protected_thinking_signature_secret: Option<Arc<str>>,
+    moderation_gate: Arc<crate::moderation::ModerationGate>,
 }
 
 struct ForcedProxyRouteStore {
diff --git a/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs b/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
index e68f518a..9d9c9843 100644
--- a/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
+++ b/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
@@ -18,11 +18,12 @@ use llm_access_anthropic_pool::{
     apply_anthropic_auth_headers, build_messages_url, merge_usage, parse_usage_from_value,
     AnthropicUsageSummary, SmoothWeightedRoundRobin, WeightedChannel, ANTHROPIC_VERSION_2023_06_01,
 };
+use llm_access_codex::request::extract_client_ip_from_headers;
 use llm_access_core::{
     provider::{ProtocolFamily, ProviderType},
     store::{
         self as core_store, AnthropicUpstreamChannelUsageDelta, AuthenticatedKey,
-        ProviderAnthropicUpstreamRoute,
+        NewModerationBannedSession, ProviderAnthropicUpstreamRoute,
     },
     usage::UsageEvent,
 };
@@ -37,6 +38,7 @@ use super::{
     },
     client::anthropic_upstream_client,
     kiro_error::kiro_json_error,
+    kiro_model::{kiro_affinity_session_id, resolve_kiro_request_session},
     kiro_protocol::normalized_kiro_messages_path,
     limiter::{kiro_key_limit_response, try_acquire_key_permit},
     usage_meta::{
@@ -46,6 +48,11 @@ use super::{
     util::{clamp_duration_ms, clamp_u64_to_i64, now_millis},
     ProviderDispatchDeps, ProviderUsageMetadata, MAX_PROVIDER_PROXY_BODY_BYTES,
 };
+use crate::moderation::{
+    derived_moderation_session_key, moderation_body_json, moderation_session_key,
+    moderation_text_for_kiro, redacted_headers_json, ModerationPrecheck,
+    MODERATION_BLOCKED_MESSAGE, MODERATION_PROVIDER_KIRO,
+};
 
 static DIRECT_ANTHROPIC_SCHEDULER: LazyLock<Mutex<SmoothWeightedRoundRobin>> =
     LazyLock::new(|| Mutex::new(SmoothWeightedRoundRobin::default()));
@@ -208,6 +215,17 @@ pub(super) async fn maybe_dispatch_anthropic_upstream_pool(
         original_model,
         preflight,
     } = prepared;
+    if let Some(response) = enforce_direct_anthropic_moderation(
+        &key,
+        public_path,
+        &original_model,
+        &replay.headers,
+        &replay.body,
+        &preflight.request,
+        &deps,
+    ) {
+        return AnthropicUpstreamDispatchOutcome::Handled(response);
+    }
     let preflight_stats = direct_anthropic_preflight_stats(&preflight);
     if preflight_stats.normalized() {
         tracing::info!(
@@ -259,6 +277,65 @@ pub(super) async fn maybe_dispatch_anthropic_upstream_pool(
     }
 }
 
+/// Enforce the keyword moderation gate on the direct Anthropic upstream path.
+/// Returns a rejection response when the session is banned or a keyword fires.
+fn enforce_direct_anthropic_moderation(
+    key: &AuthenticatedKey,
+    endpoint: &str,
+    model: &str,
+    request_headers: &HeaderMap,
+    body: &Bytes,
+    payload: &llm_access_kiro::anthropic::types::MessagesRequest,
+    deps: &ProviderDispatchDeps,
+) -> Option<axum::response::Response> {
+    let affinity_session_id =
+        resolve_kiro_request_session(request_headers, payload.metadata.as_ref());
+    let affinity_session_id = kiro_affinity_session_id(&affinity_session_id).map(str::to_string);
+    let moderation_key = match affinity_session_id.as_deref() {
+        Some(session_id) => {
+            moderation_session_key(MODERATION_PROVIDER_KIRO, &key.key_id, session_id)
+        },
+        None => derived_moderation_session_key(MODERATION_PROVIDER_KIRO, &key.key_id, body),
+    };
+    match deps.moderation_gate.precheck(Some(&moderation_key)) {
+        ModerationPrecheck::Blocked => {
+            deps.moderation_gate.note_blocked_request();
+            Some(kiro_json_error(
+                StatusCode::FORBIDDEN,
+                "permission_error",
+                MODERATION_BLOCKED_MESSAGE,
+            ))
+        },
+        ModerationPrecheck::Scan(matcher) => {
+            let scanned_text = moderation_text_for_kiro(payload);
+            let hit = matcher.find(&scanned_text)?;
+            deps.moderation_gate.note_blocked_request();
+            deps.moderation_gate
+                .ban_session(NewModerationBannedSession {
+                    session_key: moderation_key,
+                    provider: MODERATION_PROVIDER_KIRO.to_string(),
+                    key_id: key.key_id.clone(),
+                    key_name: key.key_name.clone(),
+                    session_id: affinity_session_id.unwrap_or_default(),
+                    matched_keyword: hit.keyword,
+                    matched_context: hit.context,
+                    endpoint: endpoint.to_string(),
+                    model: model.to_string(),
+                    client_ip: extract_client_ip_from_headers(request_headers),
+                    request_headers_json: redacted_headers_json(request_headers),
+                    request_body_json: moderation_body_json(body),
+                    banned_at_ms: now_millis(),
+                });
+            Some(kiro_json_error(
+                StatusCode::FORBIDDEN,
+                "permission_error",
+                MODERATION_BLOCKED_MESSAGE,
+            ))
+        },
+        ModerationPrecheck::Skip => None,
+    }
+}
+
 fn order_routes_for_request(
     mut routes: Vec<ProviderAnthropicUpstreamRoute>,
 ) -> Vec<ProviderAnthropicUpstreamRoute> {
diff --git a/crates/llm-access/src/provider/codex_dispatch.rs b/crates/llm-access/src/provider/codex_dispatch.rs
index 617eee84..697b0540 100644
--- a/crates/llm-access/src/provider/codex_dispatch.rs
+++ b/crates/llm-access/src/provider/codex_dispatch.rs
@@ -33,7 +33,7 @@ use llm_access_codex::{
     },
     types::{ChatStreamMetadata, CodexResolvedSessionSource, GatewayResponseAdapter},
 };
-use llm_access_core::store::{AuthenticatedKey, ProviderCodexRoute};
+use llm_access_core::store::{AuthenticatedKey, NewModerationBannedSession, ProviderCodexRoute};
 use rand::Rng;
 use serde_json::{json, Value};
 
@@ -70,7 +70,7 @@ use super::{
         capture_codex_prepared_request_json, capture_error_body, capture_error_bytes,
         capture_error_message, extract_model_from_json_body, strip_codex_stream_request_bodies,
     },
-    util::clamp_duration_ms,
+    util::{clamp_duration_ms, now_millis},
     CodexAccountCooldowns, CodexAffinityId, CodexAffinityRuntimeConfig, CodexAuthSnapshot,
     CodexCompletedResponseContext, CodexPreflightFailureRecord, CodexSessionAffinity,
     CodexSessionRecovery, CodexSessionRecoveryLookup, CodexSessionRecoveryStoreResult,
@@ -79,7 +79,14 @@ use super::{
     StreamRecordState, CODEX_TRANSIENT_ACCOUNT_FAILURE_COOLDOWN_MAX,
     CODEX_TRANSIENT_ACCOUNT_FAILURE_COOLDOWN_MIN, MAX_PROVIDER_PROXY_BODY_BYTES,
 };
-use crate::codex_refresh;
+use crate::{
+    codex_refresh,
+    moderation::{
+        derived_moderation_session_key, moderation_body_json, moderation_session_key,
+        moderation_text_for_json_body, redacted_headers_json, ModerationPrecheck,
+        MODERATION_BLOCKED_MESSAGE, MODERATION_PROVIDER_CODEX,
+    },
+};
 
 pub async fn dispatch_codex_proxy(
     key: AuthenticatedKey,
@@ -96,6 +103,7 @@ pub async fn dispatch_codex_proxy(
         codex_session_affinity,
         codex_session_recovery,
         codex_session_rejection,
+        moderation_gate,
         ..
     } = deps;
     let mut usage_meta = ProviderUsageMetadata::from_request_parts(
@@ -242,6 +250,60 @@ pub async fn dispatch_codex_proxy(
         prepared.resolved_session_id.as_deref(),
         prepared.resolved_session_source,
     );
+    let moderation_key = match prepared
+        .resolved_session_id
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    {
+        Some(session_id) => {
+            moderation_session_key(MODERATION_PROVIDER_CODEX, &key.key_id, session_id)
+        },
+        None => derived_moderation_session_key(MODERATION_PROVIDER_CODEX, &key.key_id, &body),
+    };
+    match moderation_gate.precheck(Some(&moderation_key)) {
+        ModerationPrecheck::Blocked => {
+            moderation_gate.note_blocked_request();
+            usage_meta.mark_session_blocked();
+            return codex_surface_error_response(
+                &gateway_path,
+                StatusCode::FORBIDDEN,
+                MODERATION_BLOCKED_MESSAGE,
+            );
+        },
+        ModerationPrecheck::Scan(matcher) => {
+            let scanned_text = moderation_text_for_json_body(&body).unwrap_or_default();
+            if let Some(hit) = matcher.find(&scanned_text) {
+                moderation_gate.note_blocked_request();
+                usage_meta.mark_session_blocked();
+                moderation_gate.ban_session(NewModerationBannedSession {
+                    session_key: moderation_key,
+                    provider: MODERATION_PROVIDER_CODEX.to_string(),
+                    key_id: key.key_id.clone(),
+                    key_name: key.key_name.clone(),
+                    session_id: prepared.resolved_session_id.clone().unwrap_or_default(),
+                    matched_keyword: hit.keyword,
+                    matched_context: hit.context,
+                    endpoint: gateway_path.clone(),
+                    model: prepared
+                        .client_visible_model
+                        .clone()
+                        .or_else(|| prepared.model.clone())
+                        .unwrap_or_default(),
+                    client_ip: usage_meta.client_ip.clone(),
+                    request_headers_json: redacted_headers_json(&request_headers),
+                    request_body_json: moderation_body_json(&body),
+                    banned_at_ms: now_millis(),
+                });
+                return codex_surface_error_response(
+                    &gateway_path,
+                    StatusCode::FORBIDDEN,
+                    MODERATION_BLOCKED_MESSAGE,
+                );
+            }
+        },
+        ModerationPrecheck::Skip => {},
+    }
     if strict_session_rejection_enabled {
         if let Some((affinity_id, rejection)) = codex_affinity_id.as_ref().and_then(|id| {
             codex_session_rejection
diff --git a/crates/llm-access/src/provider/kiro_dispatch.rs b/crates/llm-access/src/provider/kiro_dispatch.rs
index 333dcaed..1337f4a5 100644
--- a/crates/llm-access/src/provider/kiro_dispatch.rs
+++ b/crates/llm-access/src/provider/kiro_dispatch.rs
@@ -14,7 +14,9 @@ use axum::{
 };
 use futures_util::StreamExt;
 use llm_access_codex::request::external_origin;
-use llm_access_core::store::{AuthenticatedKey, ProviderKiroRoute, ProviderRouteStore};
+use llm_access_core::store::{
+    AuthenticatedKey, NewModerationBannedSession, ProviderKiroRoute, ProviderRouteStore,
+};
 use llm_access_kiro::{
     anthropic::{
         converter::{
@@ -82,7 +84,14 @@ use super::{
     KiroWebsearchUsageRecord, ProviderDispatchDeps, ProviderUsageMetadata, WebsearchResponseInput,
     KIRO_EMPTY_STREAM_MAX_RETRIES, MAX_PROVIDER_PROXY_BODY_BYTES,
 };
-use crate::kiro_refresh;
+use crate::{
+    kiro_refresh,
+    moderation::{
+        derived_moderation_session_key, moderation_body_json, moderation_session_key,
+        moderation_text_for_kiro, redacted_headers_json, ModerationPrecheck,
+        MODERATION_BLOCKED_MESSAGE, MODERATION_PROVIDER_KIRO,
+    },
+};
 
 const INCONSISTENT_ROUTE_CONFIGURATION_MESSAGE: &str = "Route configuration is inconsistent.";
 const KIRO_SAME_ACCOUNT_MAX_ATTEMPTS: usize = 3;
@@ -182,6 +191,7 @@ pub async fn dispatch_kiro_proxy(
         kiro_session_affinity,
         kiro_latency_ranker,
         protected_thinking_signature_secret,
+        moderation_gate,
         ..
     } = deps;
     let mut usage_meta = ProviderUsageMetadata::from_request_parts(
@@ -317,6 +327,49 @@ pub async fn dispatch_kiro_proxy(
     let resolved_session =
         resolve_kiro_request_session(&request_headers, payload.metadata.as_ref());
     let affinity_session_id = kiro_affinity_session_id(&resolved_session).map(str::to_string);
+    let moderation_key = match affinity_session_id.as_deref() {
+        Some(session_id) => {
+            moderation_session_key(MODERATION_PROVIDER_KIRO, &key.key_id, session_id)
+        },
+        None => derived_moderation_session_key(MODERATION_PROVIDER_KIRO, &key.key_id, &body),
+    };
+    match moderation_gate.precheck(Some(&moderation_key)) {
+        ModerationPrecheck::Blocked => {
+            moderation_gate.note_blocked_request();
+            return kiro_json_error(
+                StatusCode::FORBIDDEN,
+                "permission_error",
+                MODERATION_BLOCKED_MESSAGE,
+            );
+        },
+        ModerationPrecheck::Scan(matcher) => {
+            let scanned_text = moderation_text_for_kiro(&payload);
+            if let Some(hit) = matcher.find(&scanned_text) {
+                moderation_gate.note_blocked_request();
+                moderation_gate.ban_session(NewModerationBannedSession {
+                    session_key: moderation_key,
+                    provider: MODERATION_PROVIDER_KIRO.to_string(),
+                    key_id: key.key_id.clone(),
+                    key_name: key.key_name.clone(),
+                    session_id: affinity_session_id.clone().unwrap_or_default(),
+                    matched_keyword: hit.keyword,
+                    matched_context: hit.context,
+                    endpoint: public_path.to_string(),
+                    model: effective_model.clone(),
+                    client_ip: usage_meta.client_ip.clone(),
+                    request_headers_json: redacted_headers_json(&request_headers),
+                    request_body_json: moderation_body_json(&body),
+                    banned_at_ms: now_millis(),
+                });
+                return kiro_json_error(
+                    StatusCode::FORBIDDEN,
+                    "permission_error",
+                    MODERATION_BLOCKED_MESSAGE,
+                );
+            }
+        },
+        ModerationPrecheck::Skip => {},
+    }
     if routes[0].remote_media_resolution_enabled {
         if let Err(err) = resolve_kiro_remote_media_sources(&mut payload).await {
             let message = err.to_string();
diff --git a/crates/llm-access/src/provider/state.rs b/crates/llm-access/src/provider/state.rs
index 1aa30cdb..76cbb9c8 100644
--- a/crates/llm-access/src/provider/state.rs
+++ b/crates/llm-access/src/provider/state.rs
@@ -30,6 +30,7 @@ use super::{
 };
 use crate::{
     activity::RequestActivityTracker, geoip::GeoIpResolver, kiro_latency::KiroLatencyRanker,
+    moderation::ModerationGate,
 };
 
 fn protected_thinking_signature_secret_from_env() -> Option<Arc<str>> {
@@ -144,9 +145,15 @@ impl ProviderState {
             kiro_latency_ranker,
             request_activity,
             protected_thinking_signature_secret: protected_thinking_signature_secret_from_env(),
+            moderation_gate: ModerationGate::disabled(),
         }
     }
 
+    /// Install the shared keyword moderation gate used by provider dispatch.
+    pub fn set_moderation_gate(&mut self, moderation_gate: Arc<ModerationGate>) {
+        self.moderation_gate = moderation_gate;
+    }
+
     pub(crate) fn route_store(&self) -> Arc<dyn ProviderRouteStore> {
         Arc::clone(&self.route_store)
     }
@@ -214,6 +221,7 @@ impl ProviderState {
             kiro_session_affinity: Arc::clone(&self.kiro_session_affinity),
             kiro_latency_ranker: Arc::clone(&self.kiro_latency_ranker),
             protected_thinking_signature_secret: self.protected_thinking_signature_secret.clone(),
+            moderation_gate: Arc::clone(&self.moderation_gate),
         }
     }
 }
diff --git a/crates/llm-access/src/runtime.rs b/crates/llm-access/src/runtime.rs
index b49a28db..8ca6f858 100644
--- a/crates/llm-access/src/runtime.rs
+++ b/crates/llm-access/src/runtime.rs
@@ -12,13 +12,15 @@ use anyhow::{anyhow, Context};
 use async_trait::async_trait;
 use llm_access_core::store::{
     AdminAccountGroupStore, AdminAnthropicUpstreamStore, AdminCodexAccountStore, AdminConfigStore,
-    AdminKeyStore, AdminKiroAccountStore, AdminProxyStore, AdminReviewQueueStore, ControlStore,
-    EmptyAdminAccountGroupStore, EmptyAdminAnthropicUpstreamStore, EmptyAdminCodexAccountStore,
-    EmptyAdminConfigStore, EmptyAdminKeyStore, EmptyAdminKiroAccountStore, EmptyAdminProxyStore,
-    EmptyAdminReviewQueueStore, EmptyProviderRouteStore, EmptyPublicAccessStore,
-    EmptyPublicCommunityStore, EmptyPublicStatusStore, EmptyPublicSubmissionStore,
-    EmptyPublicUsageStore, ProviderRouteStore, PublicAccessStore, PublicCommunityStore,
-    PublicStatusStore, PublicSubmissionStore, PublicUsageStore, DEFAULT_CODEX_CLIENT_VERSION,
+    AdminKeyStore, AdminKiroAccountStore, AdminModerationStore, AdminProxyStore,
+    AdminReviewQueueStore, ControlStore, EmptyAdminAccountGroupStore,
+    EmptyAdminAnthropicUpstreamStore, EmptyAdminCodexAccountStore, EmptyAdminConfigStore,
+    EmptyAdminKeyStore, EmptyAdminKiroAccountStore, EmptyAdminModerationStore,
+    EmptyAdminProxyStore, EmptyAdminReviewQueueStore, EmptyProviderRouteStore,
+    EmptyPublicAccessStore, EmptyPublicCommunityStore, EmptyPublicStatusStore,
+    EmptyPublicSubmissionStore, EmptyPublicUsageStore, ProviderRouteStore, PublicAccessStore,
+    PublicCommunityStore, PublicStatusStore, PublicSubmissionStore, PublicUsageStore,
+    DEFAULT_CODEX_CLIENT_VERSION,
 };
 #[cfg(any(feature = "duckdb-runtime", feature = "duckdb-bundled"))]
 use llm_access_core::store::{
@@ -73,6 +75,7 @@ pub struct LlmAccessRuntime {
     admin_codex_account_store: Arc<dyn AdminCodexAccountStore>,
     admin_kiro_account_store: Arc<dyn AdminKiroAccountStore>,
     admin_anthropic_upstream_store: Arc<dyn AdminAnthropicUpstreamStore>,
+    admin_moderation_store: Arc<dyn AdminModerationStore>,
     admin_review_queue_store: Arc<dyn AdminReviewQueueStore>,
     public_access_store: Arc<dyn PublicAccessStore>,
     public_community_store: Arc<dyn PublicCommunityStore>,
@@ -104,6 +107,7 @@ struct LlmAccessStores {
     admin_codex_account_store: Arc<dyn AdminCodexAccountStore>,
     admin_kiro_account_store: Arc<dyn AdminKiroAccountStore>,
     admin_anthropic_upstream_store: Arc<dyn AdminAnthropicUpstreamStore>,
+    admin_moderation_store: Arc<dyn AdminModerationStore>,
     admin_review_queue_store: Arc<dyn AdminReviewQueueStore>,
     public_access_store: Arc<dyn PublicAccessStore>,
     public_community_store: Arc<dyn PublicCommunityStore>,
@@ -132,6 +136,7 @@ trait RuntimeRepository:
     + AdminCodexAccountStore
     + AdminKiroAccountStore
     + AdminAnthropicUpstreamStore
+    + AdminModerationStore
     + AdminReviewQueueStore
     + PublicAccessStore
     + PublicCommunityStore
@@ -155,6 +160,7 @@ impl<T> RuntimeRepository for T where
         + AdminCodexAccountStore
         + AdminKiroAccountStore
         + AdminAnthropicUpstreamStore
+        + AdminModerationStore
         + AdminReviewQueueStore
         + PublicAccessStore
         + PublicCommunityStore
@@ -178,6 +184,7 @@ trait RuntimeRepository:
     + AdminCodexAccountStore
     + AdminKiroAccountStore
     + AdminAnthropicUpstreamStore
+    + AdminModerationStore
     + AdminReviewQueueStore
     + PublicAccessStore
     + PublicCommunityStore
@@ -200,6 +207,7 @@ impl<T> RuntimeRepository for T where
         + AdminCodexAccountStore
         + AdminKiroAccountStore
         + AdminAnthropicUpstreamStore
+        + AdminModerationStore
         + AdminReviewQueueStore
         + PublicAccessStore
         + PublicCommunityStore
@@ -259,6 +267,7 @@ impl LlmAccessRuntime {
             admin_codex_account_store: Arc::new(EmptyAdminCodexAccountStore),
             admin_kiro_account_store: Arc::new(EmptyAdminKiroAccountStore),
             admin_anthropic_upstream_store: Arc::new(EmptyAdminAnthropicUpstreamStore),
+            admin_moderation_store: Arc::new(EmptyAdminModerationStore),
             admin_review_queue_store: Arc::new(EmptyAdminReviewQueueStore),
             public_access_store: Arc::new(EmptyPublicAccessStore),
             public_community_store: Arc::new(EmptyPublicCommunityStore),
@@ -293,6 +302,7 @@ impl LlmAccessRuntime {
             admin_codex_account_store: stores.admin_codex_account_store,
             admin_kiro_account_store: stores.admin_kiro_account_store,
             admin_anthropic_upstream_store: stores.admin_anthropic_upstream_store,
+            admin_moderation_store: stores.admin_moderation_store,
             admin_review_queue_store: stores.admin_review_queue_store,
             public_access_store: stores.public_access_store,
             public_community_store: stores.public_community_store,
@@ -428,6 +438,7 @@ impl LlmAccessRuntime {
         let admin_kiro_account_store: Arc<dyn AdminKiroAccountStore> = repository.clone();
         let admin_anthropic_upstream_store: Arc<dyn AdminAnthropicUpstreamStore> =
             repository.clone();
+        let admin_moderation_store: Arc<dyn AdminModerationStore> = repository.clone();
         let admin_review_queue_store: Arc<dyn AdminReviewQueueStore> = repository.clone();
         #[cfg(any(feature = "duckdb-runtime", feature = "duckdb-bundled"))]
         let public_access_store: Arc<dyn PublicAccessStore> =
@@ -460,6 +471,7 @@ impl LlmAccessRuntime {
             admin_codex_account_store,
             admin_kiro_account_store,
             admin_anthropic_upstream_store,
+            admin_moderation_store,
             admin_review_queue_store,
             public_access_store,
             public_community_store,
@@ -548,6 +560,12 @@ impl LlmAccessRuntime {
         Arc::clone(&self.admin_anthropic_upstream_store)
     }
 
+    /// Keyword moderation store used by the moderation gate and admin
+    /// endpoints.
+    pub fn admin_moderation_store(&self) -> Arc<dyn AdminModerationStore> {
+        Arc::clone(&self.admin_moderation_store)
+    }
+
     /// Admin review queue store used by local admin endpoints.
     pub fn admin_review_queue_store(&self) -> Arc<dyn AdminReviewQueueStore> {
         Arc::clone(&self.admin_review_queue_store)

From 52004df7a51ab9bd30f99b5977970d4b326d9338 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 02:52:14 +0800
Subject: [PATCH 02/11] test(llm-access-store): Postgres integration test for
 moderation store

Exercise the moderation store against a real Postgres (Neon CI branch):
keyword bulk import with within-batch and cross-call ON CONFLICT dedup,
NULLIF note coercion, delete/RETURNING, banned-session capture with JSONB
body+headers, session_key conflict dedup, status-filtered pagination,
review/unban, and the runtime snapshot contract. Gated on TEST_POSTGRES_URL
and skipped when unset, matching the existing integration tests. Adds the
two moderation tables to the reset_test_db TRUNCATE list for isolation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/llm-access-store/src/postgres.rs | 201 +++++++++++++++++++++++-
 1 file changed, 195 insertions(+), 6 deletions(-)

diff --git a/crates/llm-access-store/src/postgres.rs b/crates/llm-access-store/src/postgres.rs
index f30ee9fa..2c63289c 100644
--- a/crates/llm-access-store/src/postgres.rs
+++ b/crates/llm-access-store/src/postgres.rs
@@ -785,12 +785,13 @@ mod tests {
             AdminAnthropicUpstreamModelsStatusUpdate, AdminAnthropicUpstreamStore,
             AdminAnthropicUpstreamTestStatusUpdate, AdminCodexAccountPageQuery,
             AdminCodexAccountSortMode, AdminCodexAccountStore, AdminConfigStore, AdminKeyStore,
-            AdminKiroAccountStore, AdminPageRequest, AdminProxyConfigPatch, AdminProxyStore,
-            AdminProxyTrafficSnapshot, AdminReviewQueueStore, AnthropicUpstreamChannelUsageDelta,
-            ControlStore, KeyUsageRollupDelta, NewAdminAnthropicUpstreamChannel,
-            NewAdminProxyConfig, NewPublicAccountContributionRequest, ProviderRouteStore,
-            ProxyTrafficTotals, PublicSubmissionStore, PublicUsageStore, UsageEventSink,
-            UsageRollupBatch, UsageRollupBatchSink,
+            AdminKiroAccountStore, AdminModerationStore, AdminPageRequest, AdminProxyConfigPatch,
+            AdminProxyStore, AdminProxyTrafficSnapshot, AdminReviewQueueStore,
+            AnthropicUpstreamChannelUsageDelta, ControlStore, KeyUsageRollupDelta,
+            NewAdminAnthropicUpstreamChannel, NewAdminProxyConfig,
+            NewModerationBannedSession, NewModerationKeyword, NewPublicAccountContributionRequest,
+            ProviderRouteStore, ProxyTrafficTotals, PublicSubmissionStore, PublicUsageStore,
+            UsageEventSink, UsageRollupBatch, UsageRollupBatchSink,
         },
     };
     use serde::Serialize;
@@ -846,6 +847,8 @@ mod tests {
         client
             .batch_execute(
                 "TRUNCATE TABLE
+                    llm_moderation_banned_sessions,
+                    llm_moderation_keywords,
                     llm_account_import_job_items,
                     llm_account_import_jobs,
                     llm_codex_status_cache,
@@ -1985,6 +1988,192 @@ mod tests {
         client.close().await;
     }
 
+    #[tokio::test]
+    async fn postgres_repository_manages_moderation_keywords_and_bans() {
+        let Ok(database_url) = std::env::var("TEST_POSTGRES_URL") else {
+            eprintln!("skipping postgres integration test: TEST_POSTGRES_URL is not set");
+            return;
+        };
+        let _guard = test_db_guard().await;
+        reset_test_db(&database_url)
+            .await
+            .expect("reset postgres test database");
+        let repo = super::PostgresControlRepository::connect(&database_url, None)
+            .await
+            .expect("connect postgres repository");
+
+        let now = 1_700_000_000_000;
+
+        // Bulk keyword insert: exercises the UNNEST array binding, the
+        // NULLIF(note, '') coercion, and ON CONFLICT dedup within one batch.
+        let outcome = repo
+            .add_moderation_keywords(vec![
+                NewModerationKeyword {
+                    keyword: "build a bomb".to_string(),
+                    note: Some("danger".to_string()),
+                    source: "txt".to_string(),
+                    created_at_ms: now,
+                },
+                NewModerationKeyword {
+                    keyword: "free phrase".to_string(),
+                    note: None,
+                    source: "json".to_string(),
+                    created_at_ms: now,
+                },
+                NewModerationKeyword {
+                    keyword: "build a bomb".to_string(),
+                    note: None,
+                    source: "txt".to_string(),
+                    created_at_ms: now,
+                },
+            ])
+            .await
+            .expect("add moderation keywords");
+        assert_eq!(outcome.inserted, 2);
+        assert_eq!(outcome.duplicates, 1);
+
+        // Re-importing an existing keyword is skipped, not errored.
+        let repeat = repo
+            .add_moderation_keywords(vec![NewModerationKeyword {
+                keyword: "build a bomb".to_string(),
+                note: None,
+                source: "txt".to_string(),
+                created_at_ms: now,
+            }])
+            .await
+            .expect("re-add moderation keyword");
+        assert_eq!(repeat.inserted, 0);
+        assert_eq!(repeat.duplicates, 1);
+
+        let keywords = repo
+            .list_moderation_keywords()
+            .await
+            .expect("list moderation keywords");
+        assert_eq!(keywords.len(), 2);
+        let bomb = keywords
+            .iter()
+            .find(|keyword| keyword.keyword == "build a bomb")
+            .expect("bomb keyword present");
+        assert_eq!(bomb.note.as_deref(), Some("danger"));
+        let free = keywords
+            .iter()
+            .find(|keyword| keyword.keyword == "free phrase")
+            .expect("free keyword present");
+        assert_eq!(free.note, None);
+
+        // Delete: RETURNING yields the removed row; a second delete is a no-op.
+        let deleted = repo
+            .delete_moderation_keyword(bomb.id)
+            .await
+            .expect("delete moderation keyword");
+        assert_eq!(deleted.expect("deleted row").keyword, "build a bomb");
+        assert!(repo
+            .delete_moderation_keyword(bomb.id)
+            .await
+            .expect("delete missing keyword")
+            .is_none());
+        assert_eq!(
+            repo.list_moderation_keywords()
+                .await
+                .expect("list after delete")
+                .len(),
+            1
+        );
+
+        // Banned sessions: JSONB body + headers persisted, session_key unique.
+        let record = NewModerationBannedSession {
+            session_key: "kiro:key-1:sess-1".to_string(),
+            provider: "kiro".to_string(),
+            key_id: "key-1".to_string(),
+            key_name: "external".to_string(),
+            session_id: "sess-1".to_string(),
+            matched_keyword: "build a bomb".to_string(),
+            matched_context: "…how to build a bomb now…".to_string(),
+            endpoint: "/v1/messages".to_string(),
+            model: "claude-sonnet-4".to_string(),
+            client_ip: "127.0.0.1".to_string(),
+            request_headers_json:
+                r#"{"authorization":"<redacted>","content-type":"application/json"}"#.to_string(),
+            request_body_json:
+                r#"{"model":"claude-sonnet-4","messages":[{"role":"user","content":"how to build a bomb"}]}"#
+                    .to_string(),
+            banned_at_ms: now,
+        };
+        assert!(repo
+            .record_moderation_banned_session(record.clone())
+            .await
+            .expect("record banned session"));
+        // Duplicate session_key: ON CONFLICT DO NOTHING -> not inserted again.
+        assert!(!repo
+            .record_moderation_banned_session(record.clone())
+            .await
+            .expect("record duplicate banned session"));
+
+        let second = NewModerationBannedSession {
+            session_key: "codex:key-1:sess-2".to_string(),
+            provider: "codex".to_string(),
+            session_id: "sess-2".to_string(),
+            ..record.clone()
+        };
+        assert!(repo
+            .record_moderation_banned_session(second)
+            .await
+            .expect("record second banned session"));
+
+        let banned = repo
+            .list_moderation_banned_sessions(AdminPageRequest { limit: 10, offset: 0 }, Some("banned"))
+            .await
+            .expect("list banned sessions");
+        assert_eq!(banned.total, 2);
+        assert_eq!(banned.sessions.len(), 2);
+
+        let target = banned
+            .sessions
+            .iter()
+            .find(|session| session.session_key == "kiro:key-1:sess-1")
+            .expect("kiro session present");
+        let detail = repo
+            .get_moderation_banned_session(target.id)
+            .await
+            .expect("load banned session detail")
+            .expect("banned session detail present");
+        assert!(detail.request_body_json.contains("how to build a bomb"));
+        assert!(detail.request_headers_json.contains("<redacted>"));
+
+        // Review flow: unban records the note and flips the status filters.
+        let updated = repo
+            .set_moderation_banned_session_status(target.id, "unbanned", Some("false positive"), now + 1)
+            .await
+            .expect("review banned session")
+            .expect("reviewed session present");
+        assert_eq!(updated.status, "unbanned");
+        assert_eq!(updated.review_note.as_deref(), Some("false positive"));
+        assert_eq!(updated.reviewed_at_ms, Some(now + 1));
+
+        let still_banned = repo
+            .list_moderation_banned_sessions(AdminPageRequest { limit: 10, offset: 0 }, Some("banned"))
+            .await
+            .expect("list still-banned sessions");
+        assert_eq!(still_banned.total, 1);
+        let unbanned = repo
+            .list_moderation_banned_sessions(
+                AdminPageRequest { limit: 10, offset: 0 },
+                Some("unbanned"),
+            )
+            .await
+            .expect("list unbanned sessions");
+        assert_eq!(unbanned.total, 1);
+
+        // Runtime snapshot mirrors the in-memory gate contract exactly.
+        let snapshot = repo
+            .load_moderation_runtime_snapshot()
+            .await
+            .expect("load moderation runtime snapshot");
+        assert_eq!(snapshot.keywords.len(), 1);
+        assert_eq!(snapshot.banned_session_keys, vec!["codex:key-1:sess-2".to_string()]);
+        assert_eq!(snapshot.allowed_session_keys, vec!["kiro:key-1:sess-1".to_string()]);
+    }
+
     #[tokio::test]
     async fn postgres_repository_updates_key_usage_rollups() {
         let Ok(database_url) = std::env::var("TEST_POSTGRES_URL") else {

From d73858726116afb4f363dc4c8aec731763aef416 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 03:01:27 +0800
Subject: [PATCH 03/11] feat(llm-access-core): tokenize moderation text before
 phrase matching
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keywords and request text may contain punctuation and arbitrary spacing.
Normalize both sides through a shared tokenizer before the Aho-Corasick
phrase match: lowercase, split into terms (alphanumeric runs for
space-delimited scripts, one term per ideographic character), drop
punctuation/whitespace as separators, and rejoin with a single space.

This makes matching insensitive to punctuation/spacing (`build a bomb`
matches `Build, a  bomb!`) and, because ideographs tokenize per character,
defeats separator-injection evasion (`习.近.平` still matches `习近平`).
Term-boundary alignment on the canonical form keeps `bomb` from firing
inside `bomber`. The Halfwidth & Fullwidth Forms block is excluded from
the ideographic set so fullwidth punctuation stays a separator.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/llm-access-core/src/moderation.rs | 168 +++++++++++++++--------
 1 file changed, 112 insertions(+), 56 deletions(-)

diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
index 16a0f870..d86bb374 100644
--- a/crates/llm-access-core/src/moderation.rs
+++ b/crates/llm-access-core/src/moderation.rs
@@ -1,12 +1,21 @@
 //! Keyword moderation matching primitives shared by the request hot path and
 //! the admin import surface.
 //!
-//! Matching is phrase-oriented rather than raw `contains`: request text is
-//! reduced to a normalized form (lowercased, whitespace runs collapsed to a
-//! single space) and scanned once with an Aho-Corasick automaton over all
-//! configured keywords. Matches whose pattern edges are ASCII word characters
-//! additionally require a word boundary in the haystack, so a keyword like
-//! `ass` does not fire inside `class`, while CJK phrases match freely.
+//! Matching is a phrase (term-sequence) query rather than a raw `contains`.
+//! Both keywords and request text pass through the same tokenizer
+//! ([`normalize_moderation_text`]): text is lowercased and split into terms —
+//! maximal runs of alphanumerics for space-delimited scripts, and one term per
+//! character for ideographic scripts (CJK / kana / Hangul) — with punctuation
+//! and whitespace acting only as term separators. The terms are rejoined with a
+//! single ASCII space into a canonical form that is scanned once with an
+//! Aho-Corasick automaton over all configured keywords, requiring every hit to
+//! align to term boundaries.
+//!
+//! Because both sides are tokenized identically, punctuation and spacing in the
+//! keyword or the request no longer affect matching: `build a bomb` matches
+//! `Build, a  bomb!`, and per-character tokenization of ideographs defeats
+//! separator-injection evasion such as `习.近.平` against the keyword `习近平`.
+//! Term-boundary alignment still prevents `bomb` from firing inside `bomber`.
 
 use aho_corasick::{AhoCorasick, AhoCorasickBuilder, MatchKind};
 use serde_json::Value;
@@ -75,18 +84,14 @@ impl ModerationMatcher {
         self.patterns.len()
     }
 
-    /// Scan normalized text and return the first phrase hit that passes the
-    /// word-boundary check.
+    /// Scan tokenized text and return the first phrase hit that aligns to term
+    /// boundaries. `normalized_text` must already be
+    /// [`normalize_moderation_text`] output (canonical single-space-joined
+    /// terms).
     pub fn find(&self, normalized_text: &str) -> Option<ModerationMatch> {
         let haystack = normalized_text.as_bytes();
         for candidate in self.automaton.find_overlapping_iter(normalized_text) {
-            let pattern = self.patterns[candidate.pattern().as_usize()].as_bytes();
-            if !match_respects_word_boundaries(
-                haystack,
-                candidate.start(),
-                candidate.end(),
-                pattern,
-            ) {
+            if !match_on_term_boundaries(haystack, candidate.start(), candidate.end()) {
                 continue;
             }
             let pattern_index = candidate.pattern().as_usize();
@@ -100,28 +105,15 @@ impl ModerationMatcher {
     }
 }
 
-fn is_ascii_word_byte(byte: u8) -> bool {
-    byte.is_ascii_alphanumeric() || byte == b'_'
-}
-
-/// A pattern edge that is an ASCII word character must sit on a word boundary
-/// in the haystack; non-ASCII edges (e.g. CJK) never require one.
-fn match_respects_word_boundaries(
-    haystack: &[u8],
-    start: usize,
-    end: usize,
-    pattern: &[u8],
-) -> bool {
-    let Some((&first, &last)) = pattern.first().zip(pattern.last()) else {
-        return false;
-    };
-    if is_ascii_word_byte(first) && start > 0 && is_ascii_word_byte(haystack[start - 1]) {
-        return false;
-    }
-    if is_ascii_word_byte(last) && end < haystack.len() && is_ascii_word_byte(haystack[end]) {
-        return false;
-    }
-    true
+/// In the canonical form every term is separated by exactly one ASCII space
+/// (byte `0x20`), which never appears inside a multi-byte UTF-8 sequence, so a
+/// hit aligns to term boundaries iff it is delimited by a space or the string
+/// edge on both sides. This keeps `bomb` from firing inside the single term
+/// `bomber` while letting phrase keywords match their term sequence anywhere.
+fn match_on_term_boundaries(haystack: &[u8], start: usize, end: usize) -> bool {
+    let before_ok = start == 0 || haystack[start - 1] == b' ';
+    let after_ok = end == haystack.len() || haystack[end] == b' ';
+    before_ok && after_ok
 }
 
 fn match_context_snippet(text: &str, start: usize, end: usize) -> String {
@@ -156,22 +148,53 @@ fn match_context_snippet(text: &str, start: usize, end: usize) -> String {
     snippet
 }
 
-/// Lowercase text and collapse every whitespace run into one ASCII space so
-/// phrase keywords match regardless of formatting.
+/// Codepoint ranges for scripts written without word spacing, where each
+/// character is treated as its own term. Per-character tokenization means
+/// separators injected between characters (`习.近.平`) collapse back to the
+/// same canonical term sequence as the bare phrase, so they cannot evade a
+/// keyword.
+fn is_ideographic_char(ch: char) -> bool {
+    // Note: the Halfwidth & Fullwidth Forms block (U+FF00–FFEF) is deliberately
+    // excluded — it mixes fullwidth punctuation (，！？) with letters/digits, so
+    // its punctuation must remain a term separator, not become a term.
+    matches!(ch as u32,
+        0x3040..=0x30FF        // Hiragana + Katakana
+        | 0x3400..=0x4DBF      // CJK Unified Ideographs Extension A
+        | 0x4E00..=0x9FFF      // CJK Unified Ideographs
+        | 0xAC00..=0xD7AF      // Hangul syllables
+        | 0xF900..=0xFAFF      // CJK Compatibility Ideographs
+        | 0x20000..=0x2FA1F,   // CJK Unified Ideographs Extension B–F + supplement
+    )
+}
+
+/// Tokenize text into a canonical phrase-query form: lowercase, split into
+/// terms (alphanumeric runs for space-delimited scripts, one term per
+/// ideographic character), drop punctuation/whitespace, and rejoin terms with a
+/// single ASCII space. Both keywords and request text pass through this so
+/// matching is insensitive to punctuation and spacing differences. See the
+/// module docs.
 pub fn normalize_moderation_text(text: &str) -> String {
     let mut normalized = String::with_capacity(text.len());
-    let mut pending_space = false;
+    // Whether the previous character continued the current alphanumeric term.
+    let mut in_word_term = false;
     for ch in text.chars() {
-        if ch.is_whitespace() {
-            pending_space = !normalized.is_empty();
-            continue;
-        }
-        if pending_space {
-            normalized.push(' ');
-            pending_space = false;
-        }
-        for lower in ch.to_lowercase() {
-            normalized.push(lower);
+        if is_ideographic_char(ch) {
+            if !normalized.is_empty() {
+                normalized.push(' ');
+            }
+            normalized.push(ch);
+            in_word_term = false;
+        } else if ch.is_alphanumeric() {
+            if !in_word_term && !normalized.is_empty() {
+                normalized.push(' ');
+            }
+            for lower in ch.to_lowercase() {
+                normalized.push(lower);
+            }
+            in_word_term = true;
+        } else {
+            // Punctuation, whitespace, and symbols separate terms.
+            in_word_term = false;
         }
     }
     normalized
@@ -281,12 +304,18 @@ mod tests {
     }
 
     #[test]
-    fn normalize_collapses_whitespace_and_lowercases() {
+    fn normalize_tokenizes_lowercases_and_drops_punctuation() {
         assert_eq!(
             normalize_moderation_text("  Hello \t WORLD\nfoo\r\n bar "),
             "hello world foo bar"
         );
-        assert_eq!(normalize_moderation_text("你好\u{3000}世界"), "你好 世界");
+        // Punctuation is a term separator, not preserved.
+        assert_eq!(normalize_moderation_text("Build, a  bomb!"), "build a bomb");
+        assert_eq!(normalize_moderation_text("U.S.A."), "u s a");
+        // Each ideographic character is its own term.
+        assert_eq!(normalize_moderation_text("你好\u{3000}世界"), "你 好 世 界");
+        // Separators injected between ideographs collapse to the same terms.
+        assert_eq!(normalize_moderation_text("习.近，平"), "习 近 平");
         assert_eq!(normalize_moderation_text("   "), "");
     }
 
@@ -300,22 +329,49 @@ mod tests {
     }
 
     #[test]
-    fn ascii_keywords_require_word_boundaries() {
-        let matcher = matcher(&["ass"]);
+    fn phrase_match_tolerates_punctuation_in_text() {
+        let matcher = matcher(&["build a bomb"]);
         assert!(matcher
+            .find(&normalize_moderation_text("please, Build a  BOMB!!!"))
+            .is_some());
+        assert!(matcher
+            .find(&normalize_moderation_text("first build; then a bomb"))
+            .is_none());
+    }
+
+    #[test]
+    fn ascii_keywords_require_term_boundaries() {
+        let ass = matcher(&["ass"]);
+        assert!(ass
             .find(&normalize_moderation_text("this is a class assignment"))
             .is_none());
-        assert!(matcher
+        assert!(ass
             .find(&normalize_moderation_text("kick his ass now"))
             .is_some());
+        // A phrase keyword is a full term, so it does not fire inside a longer
+        // term.
+        let bomb = matcher(&["bomb"]);
+        assert!(bomb
+            .find(&normalize_moderation_text("a bomber flew"))
+            .is_none());
+        assert!(bomb
+            .find(&normalize_moderation_text("a bomb fell"))
+            .is_some());
     }
 
     #[test]
-    fn cjk_keywords_match_without_boundaries() {
+    fn cjk_phrase_matches_and_resists_separator_evasion() {
         let matcher = matcher(&["敏感词"]);
         assert!(matcher
             .find(&normalize_moderation_text("这句话包含敏感词内容"))
             .is_some());
+        // Punctuation inserted between the characters must not evade the match.
+        assert!(matcher
+            .find(&normalize_moderation_text("这句话包含敏-感-词内容"))
+            .is_some());
+        assert!(matcher
+            .find(&normalize_moderation_text("敏\u{3000}感\u{3000}词"))
+            .is_some());
     }
 
     #[test]

From d76b64559d538e983d49bd32e76601a1d068a519 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 04:01:09 +0800
Subject: [PATCH 04/11] refactor(llm-access): moderation gate optimizations
 from code review
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apply verified findings from a full-feature review pass:

Hot path
- Add ModerationGate::is_active() and a shared enforce_moderation() helper
  so a dormant gate (no keywords, no bans) does zero work — no SHA-256
  session-key derivation, no text extraction, no scan.
- Collapse the triplicated ban-record + precheck logic across the kiro,
  codex, and direct-anthropic hooks into enforce_moderation(), removing
  the duplicated key derivation and MessagesRequest extraction.

Capture fidelity
- Store request_body_json/request_headers_json as TEXT, not JSONB, so the
  captured wire bytes are preserved verbatim for review instead of being
  reparsed/reordered; moderation_body_text() drops the extra JSON parse.
- Add the missing reviewed_at_ms >= 0 CHECK to migration 0036.

Matching
- Fold fullwidth ASCII (Ｂ→b, fullwidth punctuation→separator) in the
  tokenizer so fullwidth-form evasion is caught.
- Drop the unused ModerationMatch.pattern_index field.

Admin & UI
- Cap keyword imports (count + per-keyword length).
- Banned-sessions review console: pagination (prev/next), a close control
  on the capture panel, clear the stale panel after a review, clear the
  error banner on a successful load, and add table header scope semantics.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/frontend/src/pages/admin_moderation.rs | 109 +++++++++++++---
 crates/llm-access-core/src/moderation.rs      |  21 +++-
 .../postgres/0036_keyword_moderation.sql      |   8 +-
 .../src/postgres/moderation.rs                |   6 +-
 crates/llm-access/src/admin.rs                |  21 ++++
 crates/llm-access/src/moderation.rs           | 117 ++++++++++++++++--
 .../provider/anthropic_upstream_dispatch.rs   |  71 ++++-------
 .../llm-access/src/provider/codex_dispatch.rs |  82 +++++-------
 .../llm-access/src/provider/kiro_dispatch.rs  |  66 +++-------
 9 files changed, 311 insertions(+), 190 deletions(-)

diff --git a/crates/frontend/src/pages/admin_moderation.rs b/crates/frontend/src/pages/admin_moderation.rs
index 1b14160c..b3a254a4 100644
--- a/crates/frontend/src/pages/admin_moderation.rs
+++ b/crates/frontend/src/pages/admin_moderation.rs
@@ -25,6 +25,7 @@ use crate::{
 
 const TAB_KEYWORDS: &str = "keywords";
 const TAB_SESSIONS: &str = "sessions";
+const SESSIONS_PAGE_SIZE: usize = 50;
 
 fn provider_badge(provider: &str) -> Classes {
     let base = classes!("rounded-full", "px-2", "py-1", "font-mono", "text-xs", "font-semibold");
@@ -72,6 +73,7 @@ pub fn admin_moderation_page() -> Html {
     let sessions = use_state(AdminModerationBannedSessionsResponse::default);
     let sessions_loading = use_state(|| true);
     let session_status = use_state(|| "banned".to_string());
+    let session_offset = use_state(|| 0usize);
     let selected_detail = use_state(|| None::<ModerationBannedSessionDetailView>);
     let detail_loading = use_state(|| false);
 
@@ -104,7 +106,10 @@ pub fn admin_moderation_page() -> Html {
             keywords_loading.set(true);
             wasm_bindgen_futures::spawn_local(async move {
                 match fetch_admin_moderation_keywords().await {
-                    Ok(response) => keywords.set(response),
+                    Ok(response) => {
+                        error.set(None);
+                        keywords.set(response);
+                    },
                     Err(message) => error.set(Some(message)),
                 }
                 keywords_loading.set(false);
@@ -113,18 +118,24 @@ pub fn admin_moderation_page() -> Html {
         });
     }
 
-    // Load banned sessions (re-runs on tick or status filter change).
+    // Load banned sessions (re-runs on tick, status filter, or page change).
     {
         let sessions = sessions.clone();
         let sessions_loading = sessions_loading.clone();
         let error = error.clone();
         let status = (*session_status).clone();
-        let deps = (*refresh_tick, status.clone());
+        let offset = *session_offset;
+        let deps = (*refresh_tick, status.clone(), offset);
         use_effect_with(deps, move |_| {
             sessions_loading.set(true);
             wasm_bindgen_futures::spawn_local(async move {
-                match fetch_admin_moderation_banned_sessions(&status, 100, 0).await {
-                    Ok(response) => sessions.set(response),
+                match fetch_admin_moderation_banned_sessions(&status, SESSIONS_PAGE_SIZE, offset)
+                    .await
+                {
+                    Ok(response) => {
+                        error.set(None);
+                        sessions.set(response);
+                    },
                     Err(message) => error.set(Some(message)),
                 }
                 sessions_loading.set(false);
@@ -273,11 +284,11 @@ pub fn admin_moderation_page() -> Html {
                             <table class={classes!("w-full", "min-w-[40rem]", "text-sm")}>
                                 <thead>
                                     <tr class={classes!("border-b", "border-[var(--border)]", "text-left", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>
-                                        <th class={classes!("px-4", "py-2")}>{ "Keyword" }</th>
-                                        <th class={classes!("px-4", "py-2")}>{ "Source" }</th>
-                                        <th class={classes!("px-4", "py-2")}>{ "Note" }</th>
-                                        <th class={classes!("px-4", "py-2")}>{ "Added" }</th>
-                                        <th class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Keyword" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Source" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Note" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Added" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
                                     </tr>
                                 </thead>
                                 <tbody>
@@ -332,6 +343,7 @@ pub fn admin_moderation_page() -> Html {
         let sessions = sessions.clone();
         let sessions_loading = sessions_loading.clone();
         let session_status = session_status.clone();
+        let session_offset = session_offset.clone();
         let selected_detail = selected_detail.clone();
         let detail_loading = detail_loading.clone();
         let notify = notify.clone();
@@ -339,15 +351,32 @@ pub fn admin_moderation_page() -> Html {
 
         let on_status_change = {
             let session_status = session_status.clone();
+            let session_offset = session_offset.clone();
             Callback::from(move |e: Event| {
                 let target: HtmlSelectElement = e.target_unchecked_into();
                 session_status.set(target.value());
+                // Reset to the first page whenever the filter changes.
+                session_offset.set(0);
+            })
+        };
+
+        let offset = *session_offset;
+        let on_prev = {
+            let session_offset = session_offset.clone();
+            Callback::from(move |_| {
+                session_offset.set(offset.saturating_sub(SESSIONS_PAGE_SIZE));
             })
         };
+        let on_next = {
+            let session_offset = session_offset.clone();
+            Callback::from(move |_| session_offset.set(offset + SESSIONS_PAGE_SIZE))
+        };
+        let page_start = if sessions.total == 0 { 0 } else { offset + 1 };
+        let page_end = offset + sessions.sessions.len();
 
         html! {
             <div class={classes!("space-y-4")}>
-                <div class={classes!("flex", "items-center", "gap-3")}>
+                <div class={classes!("flex", "flex-wrap", "items-center", "gap-3")}>
                     <span class={classes!("font-mono", "text-xs", "uppercase", "tracking-[0.16em]", "text-[var(--muted)]")}>{ "Filter" }</span>
                     <select
                         class={classes!("rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
@@ -358,8 +387,26 @@ pub fn admin_moderation_page() -> Html {
                         <option value="all" selected={*session_status == "all"}>{ "All" }</option>
                     </select>
                     <span class={classes!("text-sm", "text-[var(--muted)]")}>
-                        { format!("{} record(s)", sessions.total) }
+                        { format!("{page_start}–{page_end} of {} record(s)", sessions.total) }
                     </span>
+                    <div class={classes!("ml-auto", "flex", "items-center", "gap-2")}>
+                        <button
+                            type="button"
+                            class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")}
+                            disabled={offset == 0}
+                            onclick={on_prev}
+                        >
+                            { "‹ Prev" }
+                        </button>
+                        <button
+                            type="button"
+                            class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")}
+                            disabled={!sessions.has_more}
+                            onclick={on_next}
+                        >
+                            { "Next ›" }
+                        </button>
+                    </div>
                 </div>
 
                 <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "overflow-hidden")}>
@@ -372,12 +419,12 @@ pub fn admin_moderation_page() -> Html {
                             <table class={classes!("w-full", "min-w-[60rem]", "text-sm")}>
                                 <thead>
                                     <tr class={classes!("border-b", "border-[var(--border)]", "text-left", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>
-                                        <th class={classes!("px-4", "py-2")}>{ "Provider" }</th>
-                                        <th class={classes!("px-4", "py-2")}>{ "Key" }</th>
-                                        <th class={classes!("px-4", "py-2")}>{ "Matched keyword" }</th>
-                                        <th class={classes!("px-4", "py-2")}>{ "Status" }</th>
-                                        <th class={classes!("px-4", "py-2")}>{ "Banned at" }</th>
-                                        <th class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Provider" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Key" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Matched keyword" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Status" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Banned at" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
                                     </tr>
                                 </thead>
                                 <tbody>
@@ -407,6 +454,7 @@ pub fn admin_moderation_page() -> Html {
                                         let on_toggle = {
                                             let notify = notify.clone();
                                             let reload = reload.clone();
+                                            let selected_detail = selected_detail.clone();
                                             Callback::from(move |_| {
                                                 let target_banned = !is_banned;
                                                 let verb = if target_banned { "re-ban" } else { "unban" };
@@ -419,6 +467,7 @@ pub fn admin_moderation_page() -> Html {
                                                 };
                                                 let notify = notify.clone();
                                                 let reload = reload.clone();
+                                                let selected_detail = selected_detail.clone();
                                                 wasm_bindgen_futures::spawn_local(async move {
                                                     match review_admin_moderation_banned_session(id, &input).await {
                                                         Ok(_) => {
@@ -426,6 +475,10 @@ pub fn admin_moderation_page() -> Html {
                                                                 if target_banned { "Session re-banned".to_string() } else { "Session unbanned".to_string() },
                                                                 false,
                                                             ));
+                                                            // Close the detail panel so its now-stale status is not shown.
+                                                            if selected_detail.as_ref().is_some_and(|d| d.session.id == id) {
+                                                                selected_detail.set(None);
+                                                            }
                                                             reload.emit(());
                                                         },
                                                         Err(message) => notify.emit((message, true)),
@@ -542,9 +595,14 @@ fn detail_panel(
             </div>
         };
     }
-    let Some(detail) = (**detail).clone() else {
+    let Some(detail_value) = (**detail).clone() else {
         return Html::default();
     };
+    let on_close = {
+        let detail = detail.clone();
+        Callback::from(move |_| detail.set(None))
+    };
+    let detail = detail_value;
     let session = &detail.session;
     html! {
         <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-5", "space-y-3")}>
@@ -552,7 +610,18 @@ fn detail_panel(
                 <h3 class={classes!("font-mono", "text-sm", "font-semibold")}>
                     { format!("Captured request · session #{}", session.id) }
                 </h3>
-                <span class={status_badge(&session.status)}>{ &session.status }</span>
+                <div class={classes!("flex", "items-center", "gap-2")}>
+                    <span class={status_badge(&session.status)}>{ &session.status }</span>
+                    <button
+                        type="button"
+                        class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")}
+                        title="Close"
+                        aria-label="Close captured request"
+                        onclick={on_close}
+                    >
+                        { "✕" }
+                    </button>
+                </div>
             </div>
             <div class={classes!("grid", "gap-2", "sm:grid-cols-2", "text-sm")}>
                 { detail_field("Provider", &session.provider) }
diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
index d86bb374..66bc6ec5 100644
--- a/crates/llm-access-core/src/moderation.rs
+++ b/crates/llm-access-core/src/moderation.rs
@@ -30,9 +30,6 @@ const MODERATION_TEXT_KEYS: [&str; 4] = ["text", "content", "instructions", "sys
 /// One keyword hit inside normalized request text.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ModerationMatch {
-    /// Index of the matched pattern in the order passed to
-    /// [`ModerationMatcher::build`].
-    pub pattern_index: usize,
     /// The normalized keyword that fired.
     pub keyword: String,
     /// Context snippet around the hit taken from the normalized text.
@@ -94,10 +91,8 @@ impl ModerationMatcher {
             if !match_on_term_boundaries(haystack, candidate.start(), candidate.end()) {
                 continue;
             }
-            let pattern_index = candidate.pattern().as_usize();
             return Some(ModerationMatch {
-                pattern_index,
-                keyword: self.patterns[pattern_index].clone(),
+                keyword: self.patterns[candidate.pattern().as_usize()].clone(),
                 context: match_context_snippet(normalized_text, candidate.start(), candidate.end()),
             });
         }
@@ -167,6 +162,16 @@ fn is_ideographic_char(ch: char) -> bool {
     )
 }
 
+/// Fold fullwidth ASCII variants (U+FF01–FF5E, common in CJK input) to their
+/// ASCII equivalents so `ＢＯＭＢ` normalizes like `bomb` and fullwidth
+/// punctuation (`，！`) becomes an ASCII separator instead of a stray term.
+fn fold_fullwidth_ascii(ch: char) -> char {
+    match ch as u32 {
+        code @ 0xFF01..=0xFF5E => char::from_u32(code - 0xFEE0).unwrap_or(ch),
+        _ => ch,
+    }
+}
+
 /// Tokenize text into a canonical phrase-query form: lowercase, split into
 /// terms (alphanumeric runs for space-delimited scripts, one term per
 /// ideographic character), drop punctuation/whitespace, and rejoin terms with a
@@ -178,6 +183,7 @@ pub fn normalize_moderation_text(text: &str) -> String {
     // Whether the previous character continued the current alphanumeric term.
     let mut in_word_term = false;
     for ch in text.chars() {
+        let ch = fold_fullwidth_ascii(ch);
         if is_ideographic_char(ch) {
             if !normalized.is_empty() {
                 normalized.push(' ');
@@ -316,6 +322,9 @@ mod tests {
         assert_eq!(normalize_moderation_text("你好\u{3000}世界"), "你 好 世 界");
         // Separators injected between ideographs collapse to the same terms.
         assert_eq!(normalize_moderation_text("习.近，平"), "习 近 平");
+        // Fullwidth ASCII folds to ASCII (letters, and fullwidth comma → sep).
+        assert_eq!(normalize_moderation_text("ＢＯＭＢ"), "bomb");
+        assert_eq!(normalize_moderation_text("ｈｅｌｌｏ，ｗｏｒｌｄ"), "hello world");
         assert_eq!(normalize_moderation_text("   "), "");
     }
 
diff --git a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
index 3564ffa9..b16a1903 100644
--- a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
+++ b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
@@ -18,12 +18,14 @@ CREATE TABLE IF NOT EXISTS llm_moderation_banned_sessions (
     endpoint TEXT NOT NULL DEFAULT '',
     model TEXT NOT NULL DEFAULT '',
     client_ip TEXT NOT NULL DEFAULT '',
-    request_headers_json JSONB NOT NULL DEFAULT '{}'::jsonb,
-    request_body_json JSONB NOT NULL DEFAULT 'null'::jsonb,
+    -- Captured verbatim as TEXT (not JSONB) so the exact request bytes are
+    -- preserved for review rather than reparsed/reordered through JSONB.
+    request_headers_json TEXT NOT NULL DEFAULT '{}',
+    request_body_json TEXT NOT NULL DEFAULT '',
     status TEXT NOT NULL DEFAULT 'banned' CHECK (status IN ('banned', 'unbanned')),
     review_note TEXT,
     banned_at_ms BIGINT NOT NULL CHECK (banned_at_ms >= 0),
-    reviewed_at_ms BIGINT,
+    reviewed_at_ms BIGINT CHECK (reviewed_at_ms IS NULL OR reviewed_at_ms >= 0),
     updated_at_ms BIGINT NOT NULL CHECK (updated_at_ms >= 0)
 );
 
diff --git a/crates/llm-access-store/src/postgres/moderation.rs b/crates/llm-access-store/src/postgres/moderation.rs
index 9ddac822..c40ff463 100644
--- a/crates/llm-access-store/src/postgres/moderation.rs
+++ b/crates/llm-access-store/src/postgres/moderation.rs
@@ -178,7 +178,7 @@ impl AdminModerationStore for PostgresControlRepository {
                     banned_at_ms,
                     updated_at_ms
                  )
-                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11::jsonb, $12::jsonb,
+                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
                          'banned', $13, $13)
                  ON CONFLICT (session_key) DO NOTHING",
                 &[
@@ -279,8 +279,8 @@ impl AdminModerationStore for PostgresControlRepository {
         self.ensure_connection_alive()?;
         let sql = format!(
             "SELECT {MODERATION_BANNED_SESSION_COLUMNS},
-                    request_headers_json::text,
-                    request_body_json::text
+                    request_headers_json,
+                    request_body_json
              FROM llm_moderation_banned_sessions
              WHERE id = $1"
         );
diff --git a/crates/llm-access/src/admin.rs b/crates/llm-access/src/admin.rs
index 6aac0d5f..8e5462a3 100644
--- a/crates/llm-access/src/admin.rs
+++ b/crates/llm-access/src/admin.rs
@@ -117,6 +117,10 @@ const DEFAULT_ADMIN_REVIEW_QUEUE_LIMIT: usize = 50;
 const MAX_ADMIN_REVIEW_QUEUE_LIMIT: usize = 200;
 const DEFAULT_ADMIN_LIST_LIMIT: usize = 50;
 const MAX_ADMIN_LIST_LIMIT: usize = 200;
+/// Upper bound on keywords accepted in a single moderation import request.
+const MAX_MODERATION_KEYWORDS_PER_IMPORT: usize = 10_000;
+/// Upper bound on the character length of a single moderation keyword.
+const MAX_MODERATION_KEYWORD_CHARS: usize = 512;
 const DEFAULT_ADMIN_IMPORT_JOB_LIMIT: usize = 20;
 const MAX_ADMIN_IMPORT_JOB_LIMIT: usize = 50;
 const PROXY_CONNECTIVITY_CHECK_TIMEOUT_SECONDS: u64 = 10;
@@ -3186,6 +3190,23 @@ pub(crate) async fn add_admin_moderation_keywords(
     if parsed.is_empty() {
         return bad_request("no keywords were parsed from the payload").into_response();
     }
+    if parsed.len() > MAX_MODERATION_KEYWORDS_PER_IMPORT {
+        return bad_request(&format!(
+            "too many keywords in one import ({}); limit is {MAX_MODERATION_KEYWORDS_PER_IMPORT}",
+            parsed.len()
+        ))
+        .into_response();
+    }
+    if let Some(oversized) = parsed
+        .iter()
+        .find(|keyword| keyword.chars().count() > MAX_MODERATION_KEYWORD_CHARS)
+    {
+        return bad_request(&format!(
+            "a keyword exceeds the {MAX_MODERATION_KEYWORD_CHARS}-character limit: {}…",
+            oversized.chars().take(40).collect::<String>()
+        ))
+        .into_response();
+    }
     let note = request
         .note
         .as_deref()
diff --git a/crates/llm-access/src/moderation.rs b/crates/llm-access/src/moderation.rs
index d37b393d..88aa821d 100644
--- a/crates/llm-access/src/moderation.rs
+++ b/crates/llm-access/src/moderation.rs
@@ -18,7 +18,10 @@ use std::{
 use axum::http::HeaderMap;
 use llm_access_core::{
     moderation::{extract_moderation_text, normalize_moderation_text, ModerationMatcher},
-    store::{AdminModerationStore, EmptyAdminModerationStore, NewModerationBannedSession},
+    store::{
+        AdminModerationStore, AuthenticatedKey, EmptyAdminModerationStore,
+        NewModerationBannedSession,
+    },
 };
 use llm_access_kiro::anthropic::types::MessagesRequest;
 use serde::Serialize;
@@ -152,6 +155,18 @@ impl ModerationGate {
         }
     }
 
+    /// Whether the gate can affect any request. Dormant means loaded with no
+    /// keywords and no banned/allowlisted sessions, or not loaded yet — in
+    /// which case the hot path can skip all moderation work (session-key
+    /// derivation, text extraction, and scanning) entirely. This is a
+    /// benign check: if a keyword or ban lands between this call and the
+    /// scan, the next request picks it up.
+    pub(crate) fn is_active(&self) -> bool {
+        let state = self.state.read().expect("moderation gate lock poisoned");
+        state.loaded
+            && (state.matcher.is_some() || !state.banned.is_empty() || !state.allowed.is_empty())
+    }
+
     /// Classify one request before scanning.
     pub(crate) fn precheck(&self, session_key: Option<&str>) -> ModerationPrecheck {
         let state = self.state.read().expect("moderation gate lock poisoned");
@@ -250,6 +265,86 @@ impl ModerationGateState {
     }
 }
 
+/// Outcome of the moderation gate for one request.
+pub(crate) enum ModerationDecision {
+    /// Allow the request to proceed to upstream dispatch.
+    Allow,
+    /// Reject the request: the session is banned, either already or by a
+    /// keyword hit this call just recorded. The caller returns its
+    /// provider-specific rejection response.
+    Block,
+}
+
+/// Immutable request facts the gate needs to classify a request and, on a
+/// keyword hit, build the ban capture.
+pub(crate) struct ModerationRequest<'a> {
+    /// Provider family label ([`MODERATION_PROVIDER_KIRO`] / `_CODEX`).
+    pub provider: &'a str,
+    pub key: &'a AuthenticatedKey,
+    /// Explicit client session id when the request carried a stable one; the
+    /// gate falls back to a content-derived key otherwise.
+    pub session_id: Option<&'a str>,
+    pub endpoint: &'a str,
+    pub model: &'a str,
+    pub headers: &'a HeaderMap,
+    pub body: &'a [u8],
+    pub client_ip: &'a str,
+}
+
+/// Enforce the keyword moderation gate for one request, shared by every
+/// provider dispatch hook. `extract_text` yields the normalized text to scan
+/// and is invoked only when the gate must actually scan (keywords configured
+/// and the session is neither already banned nor allowlisted), so the caller
+/// pays the extraction cost only when it can change the outcome. Returns
+/// [`ModerationDecision::Block`] when the request must be rejected.
+pub(crate) fn enforce_moderation(
+    gate: &ModerationGate,
+    request: ModerationRequest<'_>,
+    extract_text: impl FnOnce() -> String,
+) -> ModerationDecision {
+    // Dormant gate (no keywords, no bans): do zero work — no key derivation,
+    // no text extraction, no scan.
+    if !gate.is_active() {
+        return ModerationDecision::Allow;
+    }
+    let session_key = match request.session_id {
+        Some(session_id) => {
+            moderation_session_key(request.provider, &request.key.key_id, session_id)
+        },
+        None => derived_moderation_session_key(request.provider, &request.key.key_id, request.body),
+    };
+    match gate.precheck(Some(&session_key)) {
+        ModerationPrecheck::Blocked => {
+            gate.note_blocked_request();
+            ModerationDecision::Block
+        },
+        ModerationPrecheck::Scan(matcher) => {
+            let scanned = extract_text();
+            let Some(hit) = matcher.find(&scanned) else {
+                return ModerationDecision::Allow;
+            };
+            gate.note_blocked_request();
+            gate.ban_session(NewModerationBannedSession {
+                session_key,
+                provider: request.provider.to_string(),
+                key_id: request.key.key_id.clone(),
+                key_name: request.key.key_name.clone(),
+                session_id: request.session_id.unwrap_or_default().to_string(),
+                matched_keyword: hit.keyword,
+                matched_context: hit.context,
+                endpoint: request.endpoint.to_string(),
+                model: request.model.to_string(),
+                client_ip: request.client_ip.to_string(),
+                request_headers_json: redacted_headers_json(request.headers),
+                request_body_json: moderation_body_text(request.body),
+                banned_at_ms: now_ms(),
+            });
+            ModerationDecision::Block
+        },
+        ModerationPrecheck::Skip => ModerationDecision::Allow,
+    }
+}
+
 /// Compose the runtime ban key.
 pub(crate) fn moderation_session_key(provider: &str, key_id: &str, session_id: &str) -> String {
     format!("{provider}:{key_id}:{session_id}")
@@ -297,14 +392,11 @@ pub(crate) fn redacted_headers_json(headers: &HeaderMap) -> String {
     serde_json::to_string(&serde_json::Value::Object(map)).unwrap_or_else(|_| "{}".to_string())
 }
 
-/// Ensure the captured body is valid JSON for the `jsonb` column; wrap
-/// non-JSON payloads as a JSON string.
-pub(crate) fn moderation_body_json(body: &[u8]) -> String {
-    match serde_json::from_slice::<serde_json::Value>(body) {
-        Ok(_) => String::from_utf8_lossy(body).into_owned(),
-        Err(_) => serde_json::to_string(&String::from_utf8_lossy(body))
-            .unwrap_or_else(|_| "null".to_string()),
-    }
+/// Capture the request body verbatim for review. The column is `TEXT`, so the
+/// exact wire bytes are preserved (invalid UTF-8 is lossily replaced) rather
+/// than reparsed and re-serialized through JSONB.
+pub(crate) fn moderation_body_text(body: &[u8]) -> String {
+    String::from_utf8_lossy(body).into_owned()
 }
 
 /// Normalized moderation text for a parsed Anthropic messages request.
@@ -404,9 +496,10 @@ mod tests {
     }
 
     #[test]
-    fn body_json_wraps_non_json_payloads() {
-        assert_eq!(moderation_body_json(br#"{"a":1}"#), r#"{"a":1}"#);
-        assert_eq!(moderation_body_json(b"not json"), "\"not json\"");
+    fn body_text_captures_bytes_verbatim() {
+        assert_eq!(moderation_body_text(br#"{"a":1}"#), r#"{"a":1}"#);
+        // Non-JSON bodies are captured verbatim, not JSON-wrapped.
+        assert_eq!(moderation_body_text(b"not json"), "not json");
     }
 
     #[test]
diff --git a/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs b/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
index 9d9c9843..cc7ec517 100644
--- a/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
+++ b/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
@@ -23,7 +23,7 @@ use llm_access_core::{
     provider::{ProtocolFamily, ProviderType},
     store::{
         self as core_store, AnthropicUpstreamChannelUsageDelta, AuthenticatedKey,
-        NewModerationBannedSession, ProviderAnthropicUpstreamRoute,
+        ProviderAnthropicUpstreamRoute,
     },
     usage::UsageEvent,
 };
@@ -49,8 +49,7 @@ use super::{
     ProviderDispatchDeps, ProviderUsageMetadata, MAX_PROVIDER_PROXY_BODY_BYTES,
 };
 use crate::moderation::{
-    derived_moderation_session_key, moderation_body_json, moderation_session_key,
-    moderation_text_for_kiro, redacted_headers_json, ModerationPrecheck,
+    enforce_moderation, moderation_text_for_kiro, ModerationDecision, ModerationRequest,
     MODERATION_BLOCKED_MESSAGE, MODERATION_PROVIDER_KIRO,
 };
 
@@ -288,51 +287,29 @@ fn enforce_direct_anthropic_moderation(
     payload: &llm_access_kiro::anthropic::types::MessagesRequest,
     deps: &ProviderDispatchDeps,
 ) -> Option<axum::response::Response> {
-    let affinity_session_id =
-        resolve_kiro_request_session(request_headers, payload.metadata.as_ref());
-    let affinity_session_id = kiro_affinity_session_id(&affinity_session_id).map(str::to_string);
-    let moderation_key = match affinity_session_id.as_deref() {
-        Some(session_id) => {
-            moderation_session_key(MODERATION_PROVIDER_KIRO, &key.key_id, session_id)
+    let resolved_session = resolve_kiro_request_session(request_headers, payload.metadata.as_ref());
+    let affinity_session_id = kiro_affinity_session_id(&resolved_session);
+    let client_ip = extract_client_ip_from_headers(request_headers);
+    match enforce_moderation(
+        &deps.moderation_gate,
+        ModerationRequest {
+            provider: MODERATION_PROVIDER_KIRO,
+            key,
+            session_id: affinity_session_id,
+            endpoint,
+            model,
+            headers: request_headers,
+            body,
+            client_ip: &client_ip,
         },
-        None => derived_moderation_session_key(MODERATION_PROVIDER_KIRO, &key.key_id, body),
-    };
-    match deps.moderation_gate.precheck(Some(&moderation_key)) {
-        ModerationPrecheck::Blocked => {
-            deps.moderation_gate.note_blocked_request();
-            Some(kiro_json_error(
-                StatusCode::FORBIDDEN,
-                "permission_error",
-                MODERATION_BLOCKED_MESSAGE,
-            ))
-        },
-        ModerationPrecheck::Scan(matcher) => {
-            let scanned_text = moderation_text_for_kiro(payload);
-            let hit = matcher.find(&scanned_text)?;
-            deps.moderation_gate.note_blocked_request();
-            deps.moderation_gate
-                .ban_session(NewModerationBannedSession {
-                    session_key: moderation_key,
-                    provider: MODERATION_PROVIDER_KIRO.to_string(),
-                    key_id: key.key_id.clone(),
-                    key_name: key.key_name.clone(),
-                    session_id: affinity_session_id.unwrap_or_default(),
-                    matched_keyword: hit.keyword,
-                    matched_context: hit.context,
-                    endpoint: endpoint.to_string(),
-                    model: model.to_string(),
-                    client_ip: extract_client_ip_from_headers(request_headers),
-                    request_headers_json: redacted_headers_json(request_headers),
-                    request_body_json: moderation_body_json(body),
-                    banned_at_ms: now_millis(),
-                });
-            Some(kiro_json_error(
-                StatusCode::FORBIDDEN,
-                "permission_error",
-                MODERATION_BLOCKED_MESSAGE,
-            ))
-        },
-        ModerationPrecheck::Skip => None,
+        || moderation_text_for_kiro(payload),
+    ) {
+        ModerationDecision::Block => Some(kiro_json_error(
+            StatusCode::FORBIDDEN,
+            "permission_error",
+            MODERATION_BLOCKED_MESSAGE,
+        )),
+        ModerationDecision::Allow => None,
     }
 }
 
diff --git a/crates/llm-access/src/provider/codex_dispatch.rs b/crates/llm-access/src/provider/codex_dispatch.rs
index 697b0540..a9d450f9 100644
--- a/crates/llm-access/src/provider/codex_dispatch.rs
+++ b/crates/llm-access/src/provider/codex_dispatch.rs
@@ -33,7 +33,7 @@ use llm_access_codex::{
     },
     types::{ChatStreamMetadata, CodexResolvedSessionSource, GatewayResponseAdapter},
 };
-use llm_access_core::store::{AuthenticatedKey, NewModerationBannedSession, ProviderCodexRoute};
+use llm_access_core::store::{AuthenticatedKey, ProviderCodexRoute};
 use rand::Rng;
 use serde_json::{json, Value};
 
@@ -70,7 +70,7 @@ use super::{
         capture_codex_prepared_request_json, capture_error_body, capture_error_bytes,
         capture_error_message, extract_model_from_json_body, strip_codex_stream_request_bodies,
     },
-    util::{clamp_duration_ms, now_millis},
+    util::clamp_duration_ms,
     CodexAccountCooldowns, CodexAffinityId, CodexAffinityRuntimeConfig, CodexAuthSnapshot,
     CodexCompletedResponseContext, CodexPreflightFailureRecord, CodexSessionAffinity,
     CodexSessionRecovery, CodexSessionRecoveryLookup, CodexSessionRecoveryStoreResult,
@@ -82,8 +82,7 @@ use super::{
 use crate::{
     codex_refresh,
     moderation::{
-        derived_moderation_session_key, moderation_body_json, moderation_session_key,
-        moderation_text_for_json_body, redacted_headers_json, ModerationPrecheck,
+        enforce_moderation, moderation_text_for_json_body, ModerationDecision, ModerationRequest,
         MODERATION_BLOCKED_MESSAGE, MODERATION_PROVIDER_CODEX,
     },
 };
@@ -250,59 +249,36 @@ pub async fn dispatch_codex_proxy(
         prepared.resolved_session_id.as_deref(),
         prepared.resolved_session_source,
     );
-    let moderation_key = match prepared
+    let codex_model = prepared
+        .client_visible_model
+        .clone()
+        .or_else(|| prepared.model.clone())
+        .unwrap_or_default();
+    let codex_session_id = prepared
         .resolved_session_id
         .as_deref()
         .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
-        Some(session_id) => {
-            moderation_session_key(MODERATION_PROVIDER_CODEX, &key.key_id, session_id)
+        .filter(|value| !value.is_empty());
+    if let ModerationDecision::Block = enforce_moderation(
+        &moderation_gate,
+        ModerationRequest {
+            provider: MODERATION_PROVIDER_CODEX,
+            key: &key,
+            session_id: codex_session_id,
+            endpoint: &gateway_path,
+            model: &codex_model,
+            headers: &request_headers,
+            body: &body,
+            client_ip: &usage_meta.client_ip,
         },
-        None => derived_moderation_session_key(MODERATION_PROVIDER_CODEX, &key.key_id, &body),
-    };
-    match moderation_gate.precheck(Some(&moderation_key)) {
-        ModerationPrecheck::Blocked => {
-            moderation_gate.note_blocked_request();
-            usage_meta.mark_session_blocked();
-            return codex_surface_error_response(
-                &gateway_path,
-                StatusCode::FORBIDDEN,
-                MODERATION_BLOCKED_MESSAGE,
-            );
-        },
-        ModerationPrecheck::Scan(matcher) => {
-            let scanned_text = moderation_text_for_json_body(&body).unwrap_or_default();
-            if let Some(hit) = matcher.find(&scanned_text) {
-                moderation_gate.note_blocked_request();
-                usage_meta.mark_session_blocked();
-                moderation_gate.ban_session(NewModerationBannedSession {
-                    session_key: moderation_key,
-                    provider: MODERATION_PROVIDER_CODEX.to_string(),
-                    key_id: key.key_id.clone(),
-                    key_name: key.key_name.clone(),
-                    session_id: prepared.resolved_session_id.clone().unwrap_or_default(),
-                    matched_keyword: hit.keyword,
-                    matched_context: hit.context,
-                    endpoint: gateway_path.clone(),
-                    model: prepared
-                        .client_visible_model
-                        .clone()
-                        .or_else(|| prepared.model.clone())
-                        .unwrap_or_default(),
-                    client_ip: usage_meta.client_ip.clone(),
-                    request_headers_json: redacted_headers_json(&request_headers),
-                    request_body_json: moderation_body_json(&body),
-                    banned_at_ms: now_millis(),
-                });
-                return codex_surface_error_response(
-                    &gateway_path,
-                    StatusCode::FORBIDDEN,
-                    MODERATION_BLOCKED_MESSAGE,
-                );
-            }
-        },
-        ModerationPrecheck::Skip => {},
+        || moderation_text_for_json_body(&body).unwrap_or_default(),
+    ) {
+        usage_meta.mark_session_blocked();
+        return codex_surface_error_response(
+            &gateway_path,
+            StatusCode::FORBIDDEN,
+            MODERATION_BLOCKED_MESSAGE,
+        );
     }
     if strict_session_rejection_enabled {
         if let Some((affinity_id, rejection)) = codex_affinity_id.as_ref().and_then(|id| {
diff --git a/crates/llm-access/src/provider/kiro_dispatch.rs b/crates/llm-access/src/provider/kiro_dispatch.rs
index 1337f4a5..8841b2f6 100644
--- a/crates/llm-access/src/provider/kiro_dispatch.rs
+++ b/crates/llm-access/src/provider/kiro_dispatch.rs
@@ -14,9 +14,7 @@ use axum::{
 };
 use futures_util::StreamExt;
 use llm_access_codex::request::external_origin;
-use llm_access_core::store::{
-    AuthenticatedKey, NewModerationBannedSession, ProviderKiroRoute, ProviderRouteStore,
-};
+use llm_access_core::store::{AuthenticatedKey, ProviderKiroRoute, ProviderRouteStore};
 use llm_access_kiro::{
     anthropic::{
         converter::{
@@ -87,8 +85,7 @@ use super::{
 use crate::{
     kiro_refresh,
     moderation::{
-        derived_moderation_session_key, moderation_body_json, moderation_session_key,
-        moderation_text_for_kiro, redacted_headers_json, ModerationPrecheck,
+        enforce_moderation, moderation_text_for_kiro, ModerationDecision, ModerationRequest,
         MODERATION_BLOCKED_MESSAGE, MODERATION_PROVIDER_KIRO,
     },
 };
@@ -327,48 +324,25 @@ pub async fn dispatch_kiro_proxy(
     let resolved_session =
         resolve_kiro_request_session(&request_headers, payload.metadata.as_ref());
     let affinity_session_id = kiro_affinity_session_id(&resolved_session).map(str::to_string);
-    let moderation_key = match affinity_session_id.as_deref() {
-        Some(session_id) => {
-            moderation_session_key(MODERATION_PROVIDER_KIRO, &key.key_id, session_id)
+    if let ModerationDecision::Block = enforce_moderation(
+        &moderation_gate,
+        ModerationRequest {
+            provider: MODERATION_PROVIDER_KIRO,
+            key: &key,
+            session_id: affinity_session_id.as_deref(),
+            endpoint: public_path,
+            model: &effective_model,
+            headers: &request_headers,
+            body: &body,
+            client_ip: &usage_meta.client_ip,
         },
-        None => derived_moderation_session_key(MODERATION_PROVIDER_KIRO, &key.key_id, &body),
-    };
-    match moderation_gate.precheck(Some(&moderation_key)) {
-        ModerationPrecheck::Blocked => {
-            moderation_gate.note_blocked_request();
-            return kiro_json_error(
-                StatusCode::FORBIDDEN,
-                "permission_error",
-                MODERATION_BLOCKED_MESSAGE,
-            );
-        },
-        ModerationPrecheck::Scan(matcher) => {
-            let scanned_text = moderation_text_for_kiro(&payload);
-            if let Some(hit) = matcher.find(&scanned_text) {
-                moderation_gate.note_blocked_request();
-                moderation_gate.ban_session(NewModerationBannedSession {
-                    session_key: moderation_key,
-                    provider: MODERATION_PROVIDER_KIRO.to_string(),
-                    key_id: key.key_id.clone(),
-                    key_name: key.key_name.clone(),
-                    session_id: affinity_session_id.clone().unwrap_or_default(),
-                    matched_keyword: hit.keyword,
-                    matched_context: hit.context,
-                    endpoint: public_path.to_string(),
-                    model: effective_model.clone(),
-                    client_ip: usage_meta.client_ip.clone(),
-                    request_headers_json: redacted_headers_json(&request_headers),
-                    request_body_json: moderation_body_json(&body),
-                    banned_at_ms: now_millis(),
-                });
-                return kiro_json_error(
-                    StatusCode::FORBIDDEN,
-                    "permission_error",
-                    MODERATION_BLOCKED_MESSAGE,
-                );
-            }
-        },
-        ModerationPrecheck::Skip => {},
+        || moderation_text_for_kiro(&payload),
+    ) {
+        return kiro_json_error(
+            StatusCode::FORBIDDEN,
+            "permission_error",
+            MODERATION_BLOCKED_MESSAGE,
+        );
     }
     if routes[0].remote_media_resolution_enabled {
         if let Err(err) = resolve_kiro_remote_media_sources(&mut payload).await {

From 238aedda473fcfef36ea827ce1ac61c774977792 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 04:50:46 +0800
Subject: [PATCH 05/11] docs(llm-access): visual explanation of moderation
 algorithm and flow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add diagram-driven English documentation:
- llm-access-core moderation: the tokenize → canonical-form → Aho-Corasick
  → term-boundary pipeline, worked English and CJK examples, and the
  Aho-Corasick complexity rationale (single O(n) scan over all keywords).
- llm-access moderation gate: the memory-vs-Postgres caching contract and
  the per-request enforce_moderation() decision flow (dormant → session
  key → precheck → scan → ban), as ASCII diagrams.
- Pointer comments at the three dispatch hook sites and the migration.

Comments only; no behavior change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/llm-access-core/src/moderation.rs      | 74 +++++++++++++++----
 .../postgres/0036_keyword_moderation.sql      | 13 ++++
 crates/llm-access/src/moderation.rs           | 65 ++++++++++++++--
 .../provider/anthropic_upstream_dispatch.rs   |  7 +-
 .../llm-access/src/provider/codex_dispatch.rs |  2 +
 .../llm-access/src/provider/kiro_dispatch.rs  |  4 +
 6 files changed, 145 insertions(+), 20 deletions(-)

diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
index 66bc6ec5..adb9c207 100644
--- a/crates/llm-access-core/src/moderation.rs
+++ b/crates/llm-access-core/src/moderation.rs
@@ -1,21 +1,67 @@
 //! Keyword moderation matching primitives shared by the request hot path and
 //! the admin import surface.
 //!
-//! Matching is a phrase (term-sequence) query rather than a raw `contains`.
-//! Both keywords and request text pass through the same tokenizer
-//! ([`normalize_moderation_text`]): text is lowercased and split into terms —
-//! maximal runs of alphanumerics for space-delimited scripts, and one term per
-//! character for ideographic scripts (CJK / kana / Hangul) — with punctuation
-//! and whitespace acting only as term separators. The terms are rejoined with a
-//! single ASCII space into a canonical form that is scanned once with an
-//! Aho-Corasick automaton over all configured keywords, requiring every hit to
-//! align to term boundaries.
+//! # What this does
 //!
-//! Because both sides are tokenized identically, punctuation and spacing in the
-//! keyword or the request no longer affect matching: `build a bomb` matches
-//! `Build, a  bomb!`, and per-character tokenization of ideographs defeats
-//! separator-injection evasion such as `习.近.平` against the keyword `习近平`.
-//! Term-boundary alignment still prevents `bomb` from firing inside `bomber`.
+//! Given a set of banned keywords and one request's text, decide whether the
+//! text contains any keyword — as a **phrase (term-sequence) query**, not a raw
+//! `contains`. A keyword like `build a bomb` should match `Build, a  bomb!`
+//! (punctuation/spacing differ) but not `bomber` (different term), and the CJK
+//! keyword `习近平` should still match `习.近.平` (separator-injection
+//! evasion).
+//!
+//! # The pipeline
+//!
+//! Both keywords and request text pass through the *same* tokenizer
+//! ([`normalize_moderation_text`]) so the two sides are always comparable:
+//!
+//! ```text
+//!    raw text ─▶ TOKENIZE ────────────────▶ canonical form ─▶ SCAN ─▶ BOUNDARY ─▶ hit?
+//!   (keyword or   • lowercase                "t1 t2 t3"       Aho-      each hit must
+//!    request)     • fold fullwidth ASCII     (terms joined    Corasick  be delimited by
+//!                 • split into terms:         by one space,   over ALL  a space or the
+//!                     - alnum run  = 1 term    no punct)      keywords  string edge on
+//!                     - ideograph  = 1 term                   in ONE    both sides
+//!                 • punctuation / space        ▲              pass      ▲
+//!                   = term separator (dropped) │                        │
+//!                                              └── invariant: a term never contains a space,
+//!                                                  so a space-or-edge delimited substring
+//!                                                  match == a contiguous term-sequence match
+//! ```
+//!
+//! # Worked examples
+//!
+//! English, punctuation/case/spacing insensitive:
+//!
+//! ```text
+//!   keyword  "Build a Bomb"            ─tokenize─▶  "build a bomb"      ◀── automaton pattern
+//!   request  "please, BUILD a  bomb!!" ─tokenize─▶  "please build a bomb"
+//!                                                            └──────────┘  match at term
+//!                                                                          boundary ⇒ BLOCK
+//!   request  "a bomber flew"           ─tokenize─▶  "a bomber flew"
+//!                                                       └── "bomb" is inside the single term
+//!                                                           "bomber" ⇒ boundary check rejects
+//! ```
+//!
+//! CJK, evasion-resistant (each ideograph is its own term, so separators
+//! between characters simply vanish into the same canonical form):
+//!
+//! ```text
+//!   keyword  "习近平"     ─tokenize─▶  "习 近 平"
+//!   request  "习.近，平"  ─tokenize─▶  "习 近 平"   ← dots/commas dropped as separators
+//!                                        └── identical canonical form ⇒ BLOCK
+//! ```
+//!
+//! # Why Aho-Corasick
+//!
+//! One automaton compiled from *all* keywords scans the request text in a
+//! single `O(n)` pass (n = canonical text length) that is independent of the
+//! keyword count `k` — versus `O(k·n)` for `k` separate substring searches.
+//! The automaton is built once per gate reload (see the `llm-access`
+//! `moderation` gate), never per request; matching a request is pure `O(n)`.
+//! Aho-Corasick reports substring hits, so a cheap `O(1)` term-boundary check
+//! (a byte look on each side of the hit) upgrades those substring hits to true
+//! phrase hits without a second scan.
 
 use aho_corasick::{AhoCorasick, AhoCorasickBuilder, MatchKind};
 use serde_json::Value;
diff --git a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
index b16a1903..375f2e30 100644
--- a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
+++ b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
@@ -1,3 +1,16 @@
+-- Keyword moderation, durable control-plane state.
+--
+-- The request hot path never reads these tables directly: the llm-access
+-- `moderation` gate loads a compact snapshot into process memory on startup /
+-- periodic refresh / admin change, and writes here only when a NEW session is
+-- banned. See crates/llm-access/src/moderation.rs for the caching contract.
+--
+--   llm_moderation_keywords         -- one row per banned phrase (canonical,
+--                                      already tokenized; UNIQUE for dedup)
+--   llm_moderation_banned_sessions  -- one row per banned session, with the
+--                                      captured request body + headers (TEXT,
+--                                      verbatim) for reviewer inspection
+
 CREATE TABLE IF NOT EXISTS llm_moderation_keywords (
     id BIGSERIAL PRIMARY KEY,
     keyword TEXT NOT NULL UNIQUE CHECK (length(keyword) > 0),
diff --git a/crates/llm-access/src/moderation.rs b/crates/llm-access/src/moderation.rs
index 88aa821d..d907afb2 100644
--- a/crates/llm-access/src/moderation.rs
+++ b/crates/llm-access/src/moderation.rs
@@ -1,10 +1,65 @@
 //! In-memory keyword moderation gate enforced before upstream dispatch.
 //!
-//! The gate keeps everything the hot path needs in process memory — the
-//! compiled keyword automaton plus banned/allowlisted session key sets — so
-//! request-time checks never touch Postgres. Postgres is written exactly once
-//! per newly banned session (capturing the full request body and headers for
-//! review) and read only on startup, periodic refresh, and admin mutations.
+//! This module is the request-side half of keyword moderation. The matching
+//! algorithm itself lives in [`llm_access_core::moderation`]; here we own the
+//! *caching contract* and the *per-request decision flow* that wrap it, for
+//! both the Kiro and Codex provider surfaces.
+//!
+//! # Where the data lives (caching contract)
+//!
+//! The hot path reads only process memory and never queries Postgres. Postgres
+//! is the durable control plane: read on startup / periodic refresh / admin
+//! change, and written exactly once per *newly* banned session.
+//!
+//! ```text
+//!   ┌──────────────────── in process memory (RwLock<ModerationGateState>) ────────────────┐
+//!   │  matcher : Aho-Corasick automaton compiled from every keyword                        │
+//!   │  banned  : HashSet<session_key>     allowed : HashSet<session_key>  (reviewer clears) │
+//!   └─────────────────────────────────────────────────────────────────────────────────────┘
+//!        ▲ reload(): full snapshot  — startup, every N minutes, and after any admin change
+//!        │ ban_session(): ONE spawned INSERT per new ban (body + headers), off the hot path
+//!        ▼
+//!   ┌──────────────────────────────── Postgres (control plane) ───────────────────────────┐
+//!   │  llm_moderation_keywords              llm_moderation_banned_sessions                  │
+//!   └─────────────────────────────────────────────────────────────────────────────────────┘
+//! ```
+//!
+//! # Per-request decision flow ([`enforce_moderation`])
+//!
+//! Every provider hook funnels through one function so the three call sites
+//! (Kiro-native, direct-Anthropic, Codex) stay identical. Work is done lazily:
+//! a dormant gate costs nothing, an already-banned session is rejected without
+//! scanning or writing, and the body is only tokenized/scanned when a keyword
+//! could actually match.
+//!
+//! ```text
+//!   request
+//!     │
+//!     ▼
+//!   is_active()? ──no──▶ ALLOW                         dormant gate (no keywords, no bans):
+//!     │ yes                                            no key derivation, no scan, no I/O
+//!     ▼
+//!   session_key = explicit session id, else SHA-256(body)   (content-scoped, dedups retries)
+//!     │
+//!     ▼
+//!   precheck(session_key)
+//!     ├── Blocked  (session already banned) ─────────▶ BLOCK   (no scan, no DB write)
+//!     ├── Skip     (allowlisted, or no keywords) ────▶ ALLOW
+//!     └── Scan(automaton)
+//!            │
+//!            ▼  extract user-visible text ─▶ tokenize ─▶ run automaton (see llm_access_core)
+//!          hit? ──no──▶ ALLOW
+//!            │ yes
+//!            ▼  ban_session(): insert into `banned` (memory) + spawn one Postgres capture
+//!          BLOCK  ──▶ caller returns the provider-specific rejection (Kiro/Codex error shape)
+//! ```
+//!
+//! A `BLOCK` decision stops this and every subsequent request for the session:
+//! the key is now in the in-memory `banned` set, so the next request short-
+//! circuits at `precheck` without touching the body or Postgres. A reviewer
+//! moves the key from `banned` to `allowed` via the admin API, which both
+//! updates the store and calls [`ModerationGate::apply_review`] so the running
+//! process reflects the decision immediately.
 
 use std::{
     collections::HashSet,
diff --git a/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs b/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
index cc7ec517..808bb028 100644
--- a/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
+++ b/crates/llm-access/src/provider/anthropic_upstream_dispatch.rs
@@ -277,7 +277,12 @@ pub(super) async fn maybe_dispatch_anthropic_upstream_pool(
 }
 
 /// Enforce the keyword moderation gate on the direct Anthropic upstream path.
-/// Returns a rejection response when the session is banned or a keyword fires.
+///
+/// The Anthropic-upstream pool short-circuits `dispatch_kiro_proxy` before its
+/// own moderation check runs, so this path re-applies the same gate through the
+/// shared [`enforce_moderation`] flow (see `crate::moderation`). Returns a
+/// rejection response when the session is banned or a keyword fires, else
+/// `None` to continue to upstream dispatch.
 fn enforce_direct_anthropic_moderation(
     key: &AuthenticatedKey,
     endpoint: &str,
diff --git a/crates/llm-access/src/provider/codex_dispatch.rs b/crates/llm-access/src/provider/codex_dispatch.rs
index a9d450f9..0fc24c26 100644
--- a/crates/llm-access/src/provider/codex_dispatch.rs
+++ b/crates/llm-access/src/provider/codex_dispatch.rs
@@ -259,6 +259,8 @@ pub async fn dispatch_codex_proxy(
         .as_deref()
         .map(str::trim)
         .filter(|value| !value.is_empty());
+    // Keyword moderation gate: reject (and, on a fresh keyword hit, capture and
+    // ban the session) before any upstream work. See `crate::moderation`.
     if let ModerationDecision::Block = enforce_moderation(
         &moderation_gate,
         ModerationRequest {
diff --git a/crates/llm-access/src/provider/kiro_dispatch.rs b/crates/llm-access/src/provider/kiro_dispatch.rs
index 8841b2f6..6b9607da 100644
--- a/crates/llm-access/src/provider/kiro_dispatch.rs
+++ b/crates/llm-access/src/provider/kiro_dispatch.rs
@@ -324,6 +324,10 @@ pub async fn dispatch_kiro_proxy(
     let resolved_session =
         resolve_kiro_request_session(&request_headers, payload.metadata.as_ref());
     let affinity_session_id = kiro_affinity_session_id(&resolved_session).map(str::to_string);
+    // Keyword moderation gate: reject the request (and, on a fresh keyword hit,
+    // capture and ban the session) before any upstream work. The gate is
+    // dormant-cheap and reads only in-memory state; see `crate::moderation` for
+    // the full decision flow.
     if let ModerationDecision::Block = enforce_moderation(
         &moderation_gate,
         ModerationRequest {

From fc9c93ede1eb0bd832d9354631392444c222ce41 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 04:53:41 +0800
Subject: [PATCH 06/11] docs(llm-access-core): use a neutral keyword example,
 not a person's name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the CJK moderation example `习近平` with the neutral, on-theme
`违禁词` ("banned word") in the module docs, the is_ideographic_char note,
and the tokenizer test. Same 3-ideograph shape, so the diagrams and the
separator-evasion demonstration are unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/llm-access-core/src/moderation.rs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
index adb9c207..7de38df4 100644
--- a/crates/llm-access-core/src/moderation.rs
+++ b/crates/llm-access-core/src/moderation.rs
@@ -7,7 +7,7 @@
 //! text contains any keyword — as a **phrase (term-sequence) query**, not a raw
 //! `contains`. A keyword like `build a bomb` should match `Build, a  bomb!`
 //! (punctuation/spacing differ) but not `bomber` (different term), and the CJK
-//! keyword `习近平` should still match `习.近.平` (separator-injection
+//! keyword `违禁词` should still match `违.禁.词` (separator-injection
 //! evasion).
 //!
 //! # The pipeline
@@ -47,8 +47,8 @@
 //! between characters simply vanish into the same canonical form):
 //!
 //! ```text
-//!   keyword  "习近平"     ─tokenize─▶  "习 近 平"
-//!   request  "习.近，平"  ─tokenize─▶  "习 近 平"   ← dots/commas dropped as separators
+//!   keyword  "违禁词"     ─tokenize─▶  "违 禁 词"
+//!   request  "违.禁，词"  ─tokenize─▶  "违 禁 词"   ← dots/commas dropped as separators
 //!                                        └── identical canonical form ⇒ BLOCK
 //! ```
 //!
@@ -191,7 +191,7 @@ fn match_context_snippet(text: &str, start: usize, end: usize) -> String {
 
 /// Codepoint ranges for scripts written without word spacing, where each
 /// character is treated as its own term. Per-character tokenization means
-/// separators injected between characters (`习.近.平`) collapse back to the
+/// separators injected between characters (`违.禁.词`) collapse back to the
 /// same canonical term sequence as the bare phrase, so they cannot evade a
 /// keyword.
 fn is_ideographic_char(ch: char) -> bool {
@@ -367,7 +367,7 @@ mod tests {
         // Each ideographic character is its own term.
         assert_eq!(normalize_moderation_text("你好\u{3000}世界"), "你 好 世 界");
         // Separators injected between ideographs collapse to the same terms.
-        assert_eq!(normalize_moderation_text("习.近，平"), "习 近 平");
+        assert_eq!(normalize_moderation_text("违.禁，词"), "违 禁 词");
         // Fullwidth ASCII folds to ASCII (letters, and fullwidth comma → sep).
         assert_eq!(normalize_moderation_text("ＢＯＭＢ"), "bomb");
         assert_eq!(normalize_moderation_text("ｈｅｌｌｏ，ｗｏｒｌｄ"), "hello world");

From 19eeacd157ea96e5452476c790af91c29c898f59 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 05:45:07 +0800
Subject: [PATCH 07/11] feat(llm-access): risk-category classification for
 keyword moderation

Classify moderation keywords under an 11-category risk taxonomy aligned to
the OpenAI usage policy (csam, sexual, weapons, extremism, drugs, criminal,
fraud, cyber, piracy, self_harm, jailbreak). A keyword may carry several
categories; a ban record captures the categories of the keyword that fired.

- Data model: new llm_moderation_categories table; category_codes on
  keywords and matched_categories on banned sessions (JSONB arrays, GIN
  indexed). Migration 0037 seeds the 11 categories and the 642 classified
  blocklist keywords (canonicalized through the real tokenizer). The
  classification was generated by range+override mapping and adversarially
  audited (only 1/642 corrected).
- Matcher: ModerationMatcher carries per-keyword categories; a hit returns
  them, and the gate records them on the ban.
- Store trait + Postgres: category list/add/delete (delete refuses while a
  keyword still references the code), keyword import with categories.
- Admin API: /moderation/categories list/add/delete; keyword import accepts
  a validated batch-level category set.
- Frontend: a Categories tab (manage the taxonomy), category multi-select on
  import, and severity-colored category badges on the keyword list, the
  banned-session list, and the capture detail.

The client-facing rejection stays generic (no keyword/category leak); the
admin console shows the full keyword + categories.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/frontend/src/api.rs                    | 110 +++
 crates/frontend/src/pages/admin_moderation.rs | 315 +++++++-
 .../examples/normalize_moderation.rs          |  24 +
 crates/llm-access-core/src/moderation.rs      |  56 +-
 crates/llm-access-core/src/store/empty.rs     |  23 +-
 crates/llm-access-core/src/store/mod.rs       |   6 +-
 .../llm-access-core/src/store/moderation.rs   |  49 ++
 crates/llm-access-core/src/store/traits.rs    |  27 +-
 .../postgres/0037_moderation_categories.sql   | 708 ++++++++++++++++++
 crates/llm-access-migrations/src/lib.rs       |   5 +
 crates/llm-access-store/src/postgres.rs       |  92 ++-
 .../src/postgres/moderation.rs                | 153 +++-
 crates/llm-access/src/admin.rs                | 164 ++++
 crates/llm-access/src/lib.rs                  |   9 +
 crates/llm-access/src/moderation.rs           |   3 +-
 15 files changed, 1691 insertions(+), 53 deletions(-)
 create mode 100644 crates/llm-access-core/examples/normalize_moderation.rs
 create mode 100644 crates/llm-access-migrations/migrations/postgres/0037_moderation_categories.sql

diff --git a/crates/frontend/src/api.rs b/crates/frontend/src/api.rs
index 7bd4fb78..0d121b7f 100644
--- a/crates/frontend/src/api.rs
+++ b/crates/frontend/src/api.rs
@@ -10971,11 +10971,42 @@ pub struct TestAdminAnthropicUpstreamModelInput {
 pub struct ModerationKeywordView {
     pub id: i64,
     pub keyword: String,
+    pub categories: Vec<String>,
     pub note: Option<String>,
     pub source: String,
     pub created_at_ms: i64,
 }
 
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct ModerationCategoryView {
+    pub code: String,
+    pub label: String,
+    pub description: String,
+    pub severity: String,
+    pub created_at_ms: i64,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
+#[serde(default)]
+pub struct AdminModerationCategoriesResponse {
+    pub categories: Vec<ModerationCategoryView>,
+    pub generated_at: i64,
+}
+
+#[derive(Debug, Serialize, Clone, PartialEq, Default)]
+pub struct AddAdminModerationCategoryInput {
+    pub code: String,
+    pub label: String,
+    pub description: Option<String>,
+    pub severity: Option<String>,
+}
+
+#[derive(Debug, Serialize, Clone, PartialEq, Default)]
+pub struct AddAdminModerationCategoriesInput {
+    pub categories: Vec<AddAdminModerationCategoryInput>,
+}
+
 #[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
 #[serde(default)]
 pub struct ModerationGateStatsView {
@@ -11002,6 +11033,7 @@ pub struct AddAdminModerationKeywordsInput {
     pub content: String,
     pub format: Option<String>,
     pub note: Option<String>,
+    pub categories: Vec<String>,
 }
 
 #[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Default)]
@@ -11023,6 +11055,7 @@ pub struct ModerationBannedSessionView {
     pub key_name: String,
     pub session_id: String,
     pub matched_keyword: String,
+    pub matched_categories: Vec<String>,
     pub matched_context: String,
     pub endpoint: String,
     pub model: String,
@@ -12143,6 +12176,83 @@ pub async fn delete_admin_anthropic_upstream_channel(name: &str) -> Result<(), S
     }
 }
 
+pub async fn fetch_admin_moderation_categories() -> Result<AdminModerationCategoriesResponse, String>
+{
+    #[cfg(feature = "mock")]
+    {
+        Ok(AdminModerationCategoriesResponse::default())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/categories", llm_access_admin_base());
+        let response = api_get(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        response
+            .json()
+            .await
+            .map_err(|e| format!("Parse error: {:?}", e))
+    }
+}
+
+pub async fn add_admin_moderation_categories(
+    input: &AddAdminModerationCategoriesInput,
+) -> Result<(), String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = input;
+        Ok(())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!("{}/admin/llm-gateway/moderation/categories", llm_access_admin_base());
+        let response = api_post(&url)
+            .json(input)
+            .map_err(|e| format!("Serialize error: {:?}", e))?
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        Ok(())
+    }
+}
+
+pub async fn delete_admin_moderation_category(code: &str) -> Result<(), String> {
+    #[cfg(feature = "mock")]
+    {
+        let _ = code;
+        Ok(())
+    }
+
+    #[cfg(not(feature = "mock"))]
+    {
+        let url = format!(
+            "{}/admin/llm-gateway/moderation/categories/{}",
+            llm_access_admin_base(),
+            urlencoding::encode(code)
+        );
+        let response = api_delete(&url)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {:?}", e))?;
+        if !response.ok() {
+            let text = response.text().await.unwrap_or_default();
+            return Err(format!("Failed: {text}"));
+        }
+        Ok(())
+    }
+}
+
 pub async fn fetch_admin_moderation_keywords() -> Result<AdminModerationKeywordsResponse, String> {
     #[cfg(feature = "mock")]
     {
diff --git a/crates/frontend/src/pages/admin_moderation.rs b/crates/frontend/src/pages/admin_moderation.rs
index b3a254a4..08b976df 100644
--- a/crates/frontend/src/pages/admin_moderation.rs
+++ b/crates/frontend/src/pages/admin_moderation.rs
@@ -1,9 +1,12 @@
 //! Keyword moderation review console.
 //!
-//! Two tabs: **Keywords** (import via txt/json, list, delete) and
-//! **Banned sessions** (list captured bans, inspect the full request payload,
-//! keep or lift a ban). Backed by the `/admin/llm-gateway/moderation/*`
-//! endpoints on the cloud `llm-access` service.
+//! Three tabs: **Keywords** (import via txt/json with category tagging, list,
+//! delete), **Banned sessions** (list captured bans, inspect the full request
+//! payload, keep or lift a ban), and **Categories** (manage the risk-category
+//! taxonomy). Backed by the `/admin/llm-gateway/moderation/*` endpoints on the
+//! cloud `llm-access` service.
+
+use std::collections::BTreeMap;
 
 use web_sys::{HtmlInputElement, HtmlSelectElement, HtmlTextAreaElement};
 use yew::prelude::*;
@@ -11,11 +14,14 @@ use yew_router::prelude::Link;
 
 use crate::{
     api::{
-        add_admin_moderation_keywords, delete_admin_moderation_keyword,
+        add_admin_moderation_categories, add_admin_moderation_keywords,
+        delete_admin_moderation_category, delete_admin_moderation_keyword,
         fetch_admin_moderation_banned_session, fetch_admin_moderation_banned_sessions,
-        fetch_admin_moderation_keywords, review_admin_moderation_banned_session,
-        AddAdminModerationKeywordsInput, AdminModerationBannedSessionsResponse,
-        AdminModerationKeywordsResponse, ModerationBannedSessionDetailView,
+        fetch_admin_moderation_categories, fetch_admin_moderation_keywords,
+        review_admin_moderation_banned_session, AddAdminModerationCategoriesInput,
+        AddAdminModerationCategoryInput, AddAdminModerationKeywordsInput,
+        AdminModerationBannedSessionsResponse, AdminModerationCategoriesResponse,
+        AdminModerationKeywordsResponse, ModerationBannedSessionDetailView, ModerationCategoryView,
         ReviewModerationBannedSessionInput,
     },
     components::tab_bar::render_tab_bar,
@@ -25,6 +31,7 @@ use crate::{
 
 const TAB_KEYWORDS: &str = "keywords";
 const TAB_SESSIONS: &str = "sessions";
+const TAB_CATEGORIES: &str = "categories";
 const SESSIONS_PAGE_SIZE: usize = 50;
 
 fn provider_badge(provider: &str) -> Classes {
@@ -37,6 +44,37 @@ fn provider_badge(provider: &str) -> Classes {
     classes!(base, color)
 }
 
+/// Color a category badge by the category's severity.
+fn severity_badge(severity: &str) -> Classes {
+    let base = classes!("rounded-full", "px-2", "py-0.5", "font-mono", "text-[11px]");
+    let color = match severity {
+        "critical" => classes!("bg-red-500/15", "text-red-700", "dark:text-red-200"),
+        "high" => classes!("bg-amber-500/15", "text-amber-700", "dark:text-amber-200"),
+        "low" => classes!("bg-slate-500/10", "text-slate-600", "dark:text-slate-300"),
+        _ => classes!("bg-indigo-500/10", "text-indigo-700", "dark:text-indigo-200"),
+    };
+    classes!(base, color)
+}
+
+/// Render the category codes for a keyword/ban as labeled, severity-colored
+/// badges, resolving each code to its label + severity via `lookup`.
+fn category_badges(codes: &[String], lookup: &BTreeMap<String, ModerationCategoryView>) -> Html {
+    if codes.is_empty() {
+        return html! { <span class={classes!("text-xs", "text-[var(--muted)]")}>{ "—" }</span> };
+    }
+    html! {
+        <div class={classes!("flex", "flex-wrap", "gap-1")}>
+            { for codes.iter().map(|code| {
+                let (label, severity) = lookup
+                    .get(code)
+                    .map(|c| (c.label.clone(), c.severity.clone()))
+                    .unwrap_or_else(|| (code.clone(), "medium".to_string()));
+                html! { <span class={severity_badge(&severity)} title={code.clone()}>{ label }</span> }
+            }) }
+        </div>
+    }
+}
+
 fn status_badge(status: &str) -> Classes {
     let base = classes!("rounded-full", "px-2", "py-1", "font-mono", "text-xs");
     let color = if status == "banned" {
@@ -61,12 +99,19 @@ pub fn admin_moderation_page() -> Html {
     let flash = use_state(|| None::<String>);
     let refresh_tick = use_state(|| 0u64);
 
+    // Category tab / shared lookup state.
+    let categories = use_state(AdminModerationCategoriesResponse::default);
+    let new_category_code = use_state(String::new);
+    let new_category_label = use_state(String::new);
+    let new_category_severity = use_state(|| "medium".to_string());
+
     // Keyword tab state.
     let keywords = use_state(AdminModerationKeywordsResponse::default);
     let keywords_loading = use_state(|| true);
     let import_content = use_state(String::new);
     let import_format = use_state(|| "txt".to_string());
     let import_note = use_state(String::new);
+    let import_categories = use_state(Vec::<String>::new);
     let importing = use_state(|| false);
 
     // Banned session tab state.
@@ -96,6 +141,29 @@ pub fn admin_moderation_page() -> Html {
         Callback::from(move |_| refresh_tick.set((*refresh_tick).saturating_add(1)))
     };
 
+    // Load categories (used by the Categories tab and by badge/import lookups).
+    {
+        let categories = categories.clone();
+        let error = error.clone();
+        let tick = *refresh_tick;
+        use_effect_with(tick, move |_| {
+            wasm_bindgen_futures::spawn_local(async move {
+                match fetch_admin_moderation_categories().await {
+                    Ok(response) => categories.set(response),
+                    Err(message) => error.set(Some(message)),
+                }
+            });
+            || ()
+        });
+    }
+
+    // Code -> category lookup for rendering labeled, severity-colored badges.
+    let category_lookup: BTreeMap<String, ModerationCategoryView> = categories
+        .categories
+        .iter()
+        .map(|category| (category.code.clone(), category.clone()))
+        .collect();
+
     // Load keywords.
     {
         let keywords = keywords.clone();
@@ -153,6 +221,7 @@ pub fn admin_moderation_page() -> Html {
         let import_content = import_content.clone();
         let import_format = import_format.clone();
         let import_note = import_note.clone();
+        let import_categories = import_categories.clone();
         let importing = importing.clone();
         let notify = notify.clone();
         let reload = reload.clone();
@@ -170,6 +239,7 @@ pub fn admin_moderation_page() -> Html {
                 content,
                 format: Some((*import_format).clone()),
                 note: (!note.trim().is_empty()).then(|| note.trim().to_string()),
+                categories: (*import_categories).clone(),
             };
             let importing = importing.clone();
             let notify = notify.clone();
@@ -200,9 +270,12 @@ pub fn admin_moderation_page() -> Html {
         let import_content = import_content.clone();
         let import_format = import_format.clone();
         let import_note = import_note.clone();
+        let import_categories = import_categories.clone();
         let importing = importing.clone();
         let keywords = keywords.clone();
         let keywords_loading = keywords_loading.clone();
+        let categories = categories.clone();
+        let category_lookup = category_lookup.clone();
         let notify = notify.clone();
         let reload = reload.clone();
 
@@ -272,6 +345,42 @@ pub fn admin_moderation_page() -> Html {
                             { if *importing { "Importing…" } else { "Import" } }
                         </button>
                     </div>
+                    <div>
+                        <div class={classes!("font-mono", "text-[11px]", "uppercase", "tracking-wider", "text-[var(--muted)]", "mb-1.5")}>
+                            { "Tag imported keywords with categories" }
+                        </div>
+                        if categories.categories.is_empty() {
+                            <div class={classes!("text-xs", "text-[var(--muted)]")}>
+                                { "No categories yet — add some in the Categories tab." }
+                            </div>
+                        } else {
+                            <div class={classes!("flex", "flex-wrap", "gap-2")}>
+                                { for categories.categories.iter().map(|category| {
+                                    let code = category.code.clone();
+                                    let checked = import_categories.contains(&code);
+                                    let on_toggle = {
+                                        let import_categories = import_categories.clone();
+                                        let code = code.clone();
+                                        Callback::from(move |_| {
+                                            let mut next = (*import_categories).clone();
+                                            if let Some(pos) = next.iter().position(|c| c == &code) {
+                                                next.remove(pos);
+                                            } else {
+                                                next.push(code.clone());
+                                            }
+                                            import_categories.set(next);
+                                        })
+                                    };
+                                    html! {
+                                        <label class={classes!("inline-flex", "items-center", "gap-1.5", "cursor-pointer", "rounded-lg", "border", "border-[var(--border)]", "px-2.5", "py-1")}>
+                                            <input type="checkbox" checked={checked} onchange={on_toggle} />
+                                            <span class={severity_badge(&category.severity)} title={category.code.clone()}>{ &category.label }</span>
+                                        </label>
+                                    }
+                                }) }
+                            </div>
+                        }
+                    </div>
                 </div>
 
                 <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "overflow-hidden")}>
@@ -285,6 +394,7 @@ pub fn admin_moderation_page() -> Html {
                                 <thead>
                                     <tr class={classes!("border-b", "border-[var(--border)]", "text-left", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>
                                         <th scope="col" class={classes!("px-4", "py-2")}>{ "Keyword" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Categories" }</th>
                                         <th scope="col" class={classes!("px-4", "py-2")}>{ "Source" }</th>
                                         <th scope="col" class={classes!("px-4", "py-2")}>{ "Note" }</th>
                                         <th scope="col" class={classes!("px-4", "py-2")}>{ "Added" }</th>
@@ -319,6 +429,7 @@ pub fn admin_moderation_page() -> Html {
                                         html! {
                                             <tr class={classes!("border-b", "border-[var(--border)]/50")}>
                                                 <td class={classes!("px-4", "py-2", "font-mono", "break-all")}>{ &keyword.keyword }</td>
+                                                <td class={classes!("px-4", "py-2")}>{ category_badges(&keyword.categories, &category_lookup) }</td>
                                                 <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ &keyword.source }</td>
                                                 <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ keyword.note.clone().unwrap_or_default() }</td>
                                                 <td class={classes!("px-4", "py-2", "text-[var(--muted)]", "whitespace-nowrap")}>{ format_timestamp_opt(Some(keyword.created_at_ms)) }</td>
@@ -346,6 +457,7 @@ pub fn admin_moderation_page() -> Html {
         let session_offset = session_offset.clone();
         let selected_detail = selected_detail.clone();
         let detail_loading = detail_loading.clone();
+        let category_lookup = category_lookup.clone();
         let notify = notify.clone();
         let reload = reload.clone();
 
@@ -422,6 +534,7 @@ pub fn admin_moderation_page() -> Html {
                                         <th scope="col" class={classes!("px-4", "py-2")}>{ "Provider" }</th>
                                         <th scope="col" class={classes!("px-4", "py-2")}>{ "Key" }</th>
                                         <th scope="col" class={classes!("px-4", "py-2")}>{ "Matched keyword" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Categories" }</th>
                                         <th scope="col" class={classes!("px-4", "py-2")}>{ "Status" }</th>
                                         <th scope="col" class={classes!("px-4", "py-2")}>{ "Banned at" }</th>
                                         <th scope="col" class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
@@ -497,6 +610,7 @@ pub fn admin_moderation_page() -> Html {
                                                     <div class={classes!("font-mono", "text-[10px]", "text-[var(--muted)]", "break-all")}>{ &session.key_id }</div>
                                                 </td>
                                                 <td class={classes!("px-4", "py-2", "font-mono", "text-xs", "break-all")}>{ &session.matched_keyword }</td>
+                                                <td class={classes!("px-4", "py-2")}>{ category_badges(&session.matched_categories, &category_lookup) }</td>
                                                 <td class={classes!("px-4", "py-2")}>
                                                     <span class={status_badge(&session.status)}>{ &session.status }</span>
                                                 </td>
@@ -522,7 +636,175 @@ pub fn admin_moderation_page() -> Html {
                     }
                 </div>
 
-                { detail_panel(&selected_detail, *detail_loading) }
+                { detail_panel(&selected_detail, *detail_loading, &category_lookup) }
+            </div>
+        }
+    };
+
+    let categories_view = {
+        let categories = categories.clone();
+        let new_category_code = new_category_code.clone();
+        let new_category_label = new_category_label.clone();
+        let new_category_severity = new_category_severity.clone();
+        let notify = notify.clone();
+        let reload = reload.clone();
+
+        let on_code_input = {
+            let new_category_code = new_category_code.clone();
+            Callback::from(move |e: InputEvent| {
+                let target: HtmlInputElement = e.target_unchecked_into();
+                new_category_code.set(target.value());
+            })
+        };
+        let on_label_input = {
+            let new_category_label = new_category_label.clone();
+            Callback::from(move |e: InputEvent| {
+                let target: HtmlInputElement = e.target_unchecked_into();
+                new_category_label.set(target.value());
+            })
+        };
+        let on_severity_change = {
+            let new_category_severity = new_category_severity.clone();
+            Callback::from(move |e: Event| {
+                let target: HtmlSelectElement = e.target_unchecked_into();
+                new_category_severity.set(target.value());
+            })
+        };
+        let on_add_category = {
+            let new_category_code = new_category_code.clone();
+            let new_category_label = new_category_label.clone();
+            let new_category_severity = new_category_severity.clone();
+            let notify = notify.clone();
+            let reload = reload.clone();
+            Callback::from(move |_| {
+                let code = (*new_category_code).clone();
+                let label = (*new_category_label).clone();
+                if code.trim().is_empty() || label.trim().is_empty() {
+                    notify.emit(("Category code and label are required".to_string(), true));
+                    return;
+                }
+                let input = AddAdminModerationCategoriesInput {
+                    categories: vec![AddAdminModerationCategoryInput {
+                        code: code.trim().to_string(),
+                        label: label.trim().to_string(),
+                        description: None,
+                        severity: Some((*new_category_severity).clone()),
+                    }],
+                };
+                let notify = notify.clone();
+                let reload = reload.clone();
+                let new_category_code = new_category_code.clone();
+                let new_category_label = new_category_label.clone();
+                wasm_bindgen_futures::spawn_local(async move {
+                    match add_admin_moderation_categories(&input).await {
+                        Ok(()) => {
+                            notify.emit(("Category added".to_string(), false));
+                            new_category_code.set(String::new());
+                            new_category_label.set(String::new());
+                            reload.emit(());
+                        },
+                        Err(message) => notify.emit((message, true)),
+                    }
+                });
+            })
+        };
+
+        html! {
+            <div class={classes!("space-y-4")}>
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "p-5", "space-y-3")}>
+                    <h3 class={classes!("font-mono", "text-xs", "uppercase", "tracking-[0.16em]", "text-[var(--muted)]")}>
+                        { "Add category" }
+                    </h3>
+                    <div class={classes!("flex", "flex-wrap", "items-center", "gap-3")}>
+                        <input
+                            type="text"
+                            class={classes!("rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm", "font-mono")}
+                            placeholder="code (a-z0-9_)"
+                            value={(*new_category_code).clone()}
+                            oninput={on_code_input}
+                        />
+                        <input
+                            type="text"
+                            class={classes!("flex-1", "min-w-[12rem]", "rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                            placeholder="label"
+                            value={(*new_category_label).clone()}
+                            oninput={on_label_input}
+                        />
+                        <select
+                            class={classes!("rounded-lg", "border", "border-[var(--border)]", "bg-[var(--bg)]", "px-3", "py-2", "text-sm")}
+                            onchange={on_severity_change}
+                        >
+                            { for ["critical", "high", "medium", "low"].iter().map(|sev| html! {
+                                <option value={*sev} selected={*new_category_severity == *sev}>{ *sev }</option>
+                            }) }
+                        </select>
+                        <button type="button" class={classes!("btn-terminal", "btn-terminal-primary")} onclick={on_add_category}>
+                            { "Add" }
+                        </button>
+                    </div>
+                </div>
+
+                <div class={classes!("rounded-xl", "border", "border-[var(--border)]", "bg-[var(--surface)]", "overflow-hidden")}>
+                    if categories.categories.is_empty() {
+                        <div class={classes!("p-5", "text-sm", "text-[var(--muted)]")}>{ "No categories configured." }</div>
+                    } else {
+                        <div class={classes!("overflow-x-auto")}>
+                            <table class={classes!("w-full", "min-w-[40rem]", "text-sm")}>
+                                <thead>
+                                    <tr class={classes!("border-b", "border-[var(--border)]", "text-left", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Category" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Code" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Severity" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2")}>{ "Description" }</th>
+                                        <th scope="col" class={classes!("px-4", "py-2", "text-right")}>{ "Actions" }</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    { for categories.categories.iter().map(|category| {
+                                        let code = category.code.clone();
+                                        let on_delete = {
+                                            let notify = notify.clone();
+                                            let reload = reload.clone();
+                                            let code = code.clone();
+                                            Callback::from(move |_| {
+                                                if !confirm_destructive(&format!("Delete category \"{code}\"?")) {
+                                                    return;
+                                                }
+                                                let notify = notify.clone();
+                                                let reload = reload.clone();
+                                                let code = code.clone();
+                                                wasm_bindgen_futures::spawn_local(async move {
+                                                    match delete_admin_moderation_category(&code).await {
+                                                        Ok(()) => {
+                                                            notify.emit(("Category deleted".to_string(), false));
+                                                            reload.emit(());
+                                                        },
+                                                        Err(message) => notify.emit((message, true)),
+                                                    }
+                                                });
+                                            })
+                                        };
+                                        html! {
+                                            <tr class={classes!("border-b", "border-[var(--border)]/50")}>
+                                                <td class={classes!("px-4", "py-2")}>
+                                                    <span class={severity_badge(&category.severity)}>{ &category.label }</span>
+                                                </td>
+                                                <td class={classes!("px-4", "py-2", "font-mono", "text-xs")}>{ &category.code }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ &category.severity }</td>
+                                                <td class={classes!("px-4", "py-2", "text-[var(--muted)]")}>{ &category.description }</td>
+                                                <td class={classes!("px-4", "py-2", "text-right")}>
+                                                    <button type="button" class={classes!("btn-terminal", "!px-2.5", "!py-1.5", "!text-xs")} onclick={on_delete}>
+                                                        { "Delete" }
+                                                    </button>
+                                                </td>
+                                            </tr>
+                                        }
+                                    }) }
+                                </tbody>
+                            </table>
+                        </div>
+                    }
+                </div>
             </div>
         }
     };
@@ -560,15 +842,21 @@ pub fn admin_moderation_page() -> Html {
 
                 { render_tab_bar(
                     &active_tab,
-                    &[(TAB_KEYWORDS, "Keywords"), (TAB_SESSIONS, "Banned sessions")],
+                    &[
+                        (TAB_KEYWORDS, "Keywords"),
+                        (TAB_SESSIONS, "Banned sessions"),
+                        (TAB_CATEGORIES, "Categories"),
+                    ],
                     &on_tab_click,
                     None,
                 ) }
 
                 if *active_tab == TAB_KEYWORDS {
                     { keywords_view }
-                } else {
+                } else if *active_tab == TAB_SESSIONS {
                     { sessions_view }
+                } else {
+                    { categories_view }
                 }
             </div>
         </main>
@@ -587,6 +875,7 @@ fn stat_card(label: &str, value: String, loaded: bool) -> Html {
 fn detail_panel(
     detail: &UseStateHandle<Option<ModerationBannedSessionDetailView>>,
     loading: bool,
+    category_lookup: &BTreeMap<String, ModerationCategoryView>,
 ) -> Html {
     if loading {
         return html! {
@@ -631,6 +920,10 @@ fn detail_panel(
                 { detail_field("Session id", &session.session_id) }
                 { detail_field("Matched keyword", &session.matched_keyword) }
             </div>
+            <div class={classes!("flex", "items-center", "gap-2")}>
+                <span class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>{ "Categories:" }</span>
+                { category_badges(&session.matched_categories, category_lookup) }
+            </div>
             if !session.matched_context.is_empty() {
                 <div>
                     <div class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]", "mb-1")}>{ "Matched context" }</div>
diff --git a/crates/llm-access-core/examples/normalize_moderation.rs b/crates/llm-access-core/examples/normalize_moderation.rs
new file mode 100644
index 00000000..d3c3524d
--- /dev/null
+++ b/crates/llm-access-core/examples/normalize_moderation.rs
@@ -0,0 +1,24 @@
+//! Normalize one moderation keyword per input line into the canonical tokenized
+//! form used by the runtime matcher and the admin import path.
+//!
+//! Usage: `cargo run -p llm-access-core --example normalize_moderation -- IN
+//! OUT` Reads `IN` (one keyword per line, UTF-8), writes `OUT` with the
+//! normalized form of each line. Empty results are preserved as blank lines so
+//! the caller can zip output lines back to input lines by index.
+
+use std::{env, fs};
+
+use llm_access_core::moderation::normalize_moderation_text;
+
+fn main() {
+    let args: Vec<String> = env::args().collect();
+    let input_path = args.get(1).expect("usage: normalize_moderation IN OUT");
+    let output_path = args.get(2).expect("usage: normalize_moderation IN OUT");
+    let input = fs::read_to_string(input_path).expect("read input file");
+    let mut output = String::with_capacity(input.len());
+    for line in input.lines() {
+        output.push_str(&normalize_moderation_text(line));
+        output.push('\n');
+    }
+    fs::write(output_path, output).expect("write output file");
+}
diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
index 7de38df4..8822206d 100644
--- a/crates/llm-access-core/src/moderation.rs
+++ b/crates/llm-access-core/src/moderation.rs
@@ -78,14 +78,19 @@ const MODERATION_TEXT_KEYS: [&str; 4] = ["text", "content", "instructions", "sys
 pub struct ModerationMatch {
     /// The normalized keyword that fired.
     pub keyword: String,
+    /// Risk-category codes attached to the keyword that fired (a keyword may
+    /// belong to several categories, e.g. `["fraud", "cyber"]`).
+    pub categories: Vec<String>,
     /// Context snippet around the hit taken from the normalized text.
     pub context: String,
 }
 
-/// Compiled multi-pattern keyword matcher.
+/// Compiled multi-pattern keyword matcher. `patterns` and `categories` are
+/// parallel: `categories[i]` are the category codes for `patterns[i]`.
 pub struct ModerationMatcher {
     automaton: AhoCorasick,
     patterns: Vec<String>,
+    categories: Vec<Vec<String>>,
 }
 
 impl std::fmt::Debug for ModerationMatcher {
@@ -97,18 +102,24 @@ impl std::fmt::Debug for ModerationMatcher {
 }
 
 impl ModerationMatcher {
-    /// Compile normalized keywords into one scan automaton. Empty patterns are
+    /// Compile normalized keywords — each paired with its risk-category codes —
+    /// into one scan automaton. Empty patterns (and their categories) are
     /// skipped; returns `None` when no usable pattern remains.
     pub fn build<I, S>(keywords: I) -> anyhow::Result<Option<Self>>
     where
-        I: IntoIterator<Item = S>,
+        I: IntoIterator<Item = (S, Vec<String>)>,
         S: AsRef<str>,
     {
-        let patterns: Vec<String> = keywords
-            .into_iter()
-            .map(|keyword| normalize_moderation_text(keyword.as_ref()))
-            .filter(|keyword| !keyword.is_empty())
-            .collect();
+        let mut patterns = Vec::new();
+        let mut categories = Vec::new();
+        for (keyword, keyword_categories) in keywords {
+            let normalized = normalize_moderation_text(keyword.as_ref());
+            if normalized.is_empty() {
+                continue;
+            }
+            patterns.push(normalized);
+            categories.push(keyword_categories);
+        }
         if patterns.is_empty() {
             return Ok(None);
         }
@@ -119,6 +130,7 @@ impl ModerationMatcher {
         Ok(Some(Self {
             automaton,
             patterns,
+            categories,
         }))
     }
 
@@ -137,8 +149,10 @@ impl ModerationMatcher {
             if !match_on_term_boundaries(haystack, candidate.start(), candidate.end()) {
                 continue;
             }
+            let index = candidate.pattern().as_usize();
             return Some(ModerationMatch {
-                keyword: self.patterns[candidate.pattern().as_usize()].clone(),
+                keyword: self.patterns[index].clone(),
+                categories: self.categories[index].clone(),
                 context: match_context_snippet(normalized_text, candidate.start(), candidate.end()),
             });
         }
@@ -350,7 +364,7 @@ mod tests {
     use super::*;
 
     fn matcher(keywords: &[&str]) -> ModerationMatcher {
-        ModerationMatcher::build(keywords.iter().copied())
+        ModerationMatcher::build(keywords.iter().map(|keyword| (*keyword, Vec::new())))
             .expect("build matcher")
             .expect("matcher should have patterns")
     }
@@ -517,11 +531,29 @@ mod tests {
 
     #[test]
     fn empty_keyword_set_builds_no_matcher() {
-        assert!(ModerationMatcher::build(Vec::<String>::new())
+        assert!(ModerationMatcher::build(Vec::<(String, Vec<String>)>::new())
             .expect("build")
             .is_none());
-        assert!(ModerationMatcher::build(vec!["   ", "\n"])
+        assert!(ModerationMatcher::build(vec![("   ", Vec::new()), ("\n", Vec::new())])
             .expect("build")
             .is_none());
     }
+
+    #[test]
+    fn match_carries_keyword_categories() {
+        let matcher = ModerationMatcher::build(vec![
+            ("build a bomb", vec!["weapons".to_string()]),
+            ("carding tutorial", vec!["fraud".to_string(), "cyber".to_string()]),
+        ])
+        .expect("build")
+        .expect("matcher");
+        let weapons = matcher
+            .find(&normalize_moderation_text("how to build a bomb"))
+            .expect("weapons hit");
+        assert_eq!(weapons.categories, vec!["weapons".to_string()]);
+        let fraud = matcher
+            .find(&normalize_moderation_text("a carding tutorial please"))
+            .expect("fraud hit");
+        assert_eq!(fraud.categories, vec!["fraud".to_string(), "cyber".to_string()]);
+    }
 }
diff --git a/crates/llm-access-core/src/store/empty.rs b/crates/llm-access-core/src/store/empty.rs
index 567aa605..f285104c 100644
--- a/crates/llm-access-core/src/store/empty.rs
+++ b/crates/llm-access-core/src/store/empty.rs
@@ -33,8 +33,9 @@ use super::{
     },
     moderation::{
         ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
-        ModerationKeyword, ModerationKeywordImportOutcome, ModerationRuntimeSnapshot,
-        NewModerationBannedSession, NewModerationKeyword,
+        ModerationCategory, ModerationKeyword, ModerationKeywordImportOutcome,
+        ModerationRuntimeSnapshot, NewModerationBannedSession, NewModerationCategory,
+        NewModerationKeyword,
     },
     proxy::{
         default_proxy_binding, default_proxy_bindings, AdminProxyBinding, AdminProxyConfig,
@@ -87,6 +88,24 @@ impl AdminModerationStore for EmptyAdminModerationStore {
         Ok(ModerationRuntimeSnapshot::default())
     }
 
+    async fn list_moderation_categories(&self) -> anyhow::Result<Vec<ModerationCategory>> {
+        Ok(Vec::new())
+    }
+
+    async fn add_moderation_categories(
+        &self,
+        _categories: Vec<NewModerationCategory>,
+    ) -> anyhow::Result<usize> {
+        anyhow::bail!("moderation store is not configured")
+    }
+
+    async fn delete_moderation_category(
+        &self,
+        _code: &str,
+    ) -> anyhow::Result<Option<ModerationCategory>> {
+        Ok(None)
+    }
+
     async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>> {
         Ok(Vec::new())
     }
diff --git a/crates/llm-access-core/src/store/mod.rs b/crates/llm-access-core/src/store/mod.rs
index 27b36aa8..118e34d2 100644
--- a/crates/llm-access-core/src/store/mod.rs
+++ b/crates/llm-access-core/src/store/mod.rs
@@ -79,8 +79,10 @@ pub use kiro_model_routing::{
 };
 pub use moderation::{
     ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
-    ModerationKeyword, ModerationKeywordImportOutcome, ModerationRuntimeSnapshot,
-    NewModerationBannedSession, NewModerationKeyword, MODERATION_KEYWORD_SOURCE_JSON,
+    ModerationCategory, ModerationKeyword, ModerationKeywordImportOutcome,
+    ModerationRuntimeSnapshot, NewModerationBannedSession, NewModerationCategory,
+    NewModerationKeyword, MODERATION_CATEGORY_SEVERITY_CRITICAL,
+    MODERATION_CATEGORY_SEVERITY_MEDIUM, MODERATION_KEYWORD_SOURCE_JSON,
     MODERATION_KEYWORD_SOURCE_TXT, MODERATION_SESSION_STATUS_BANNED,
     MODERATION_SESSION_STATUS_UNBANNED,
 };
diff --git a/crates/llm-access-core/src/store/moderation.rs b/crates/llm-access-core/src/store/moderation.rs
index 59e9ef18..c1b7e152 100644
--- a/crates/llm-access-core/src/store/moderation.rs
+++ b/crates/llm-access-core/src/store/moderation.rs
@@ -13,6 +13,45 @@ pub const MODERATION_KEYWORD_SOURCE_TXT: &str = "txt";
 /// Keyword import source label for JSON payloads.
 pub const MODERATION_KEYWORD_SOURCE_JSON: &str = "json";
 
+/// Category severity: reserved for the highest-harm categories (CSAM, weapons,
+/// self-harm, …).
+pub const MODERATION_CATEGORY_SEVERITY_CRITICAL: &str = "critical";
+/// Category severity default.
+pub const MODERATION_CATEGORY_SEVERITY_MEDIUM: &str = "medium";
+
+/// One risk category a keyword can be classified under. Categories are managed
+/// separately from keywords (see
+/// [`AdminModerationStore`](super::AdminModerationStore)), and a keyword may
+/// reference several by [`code`](ModerationCategory::code).
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationCategory {
+    /// Stable machine code, e.g. `csam`, `cyber`. Referenced by keywords.
+    pub code: String,
+    /// Human-facing label (may be bilingual).
+    pub label: String,
+    /// Longer description shown in the admin console.
+    pub description: String,
+    /// `critical` / `high` / `medium` / `low`.
+    pub severity: String,
+    /// Creation timestamp.
+    pub created_at_ms: i64,
+}
+
+/// Insert payload for one risk category.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct NewModerationCategory {
+    /// Stable machine code.
+    pub code: String,
+    /// Human-facing label.
+    pub label: String,
+    /// Longer description.
+    pub description: String,
+    /// Severity bucket.
+    pub severity: String,
+    /// Creation timestamp.
+    pub created_at_ms: i64,
+}
+
 /// One configured moderation keyword.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct ModerationKeyword {
@@ -20,6 +59,9 @@ pub struct ModerationKeyword {
     pub id: i64,
     /// Normalized keyword phrase (lowercased, single-space separated).
     pub keyword: String,
+    /// Risk-category codes this keyword is classified under (may be several).
+    #[serde(default)]
+    pub categories: Vec<String>,
     /// Optional reviewer note.
     pub note: Option<String>,
     /// Import source: `txt` or `json`.
@@ -33,6 +75,8 @@ pub struct ModerationKeyword {
 pub struct NewModerationKeyword {
     /// Normalized keyword phrase.
     pub keyword: String,
+    /// Risk-category codes to classify this keyword under.
+    pub categories: Vec<String>,
     /// Optional reviewer note.
     pub note: Option<String>,
     /// Import source: `txt` or `json`.
@@ -67,6 +111,9 @@ pub struct ModerationBannedSession {
     pub session_id: String,
     /// Normalized keyword that fired.
     pub matched_keyword: String,
+    /// Risk-category codes of the keyword that fired.
+    #[serde(default)]
+    pub matched_categories: Vec<String>,
     /// Context snippet around the hit from the normalized request text.
     pub matched_context: String,
     /// Gateway endpoint that received the blocked request.
@@ -113,6 +160,8 @@ pub struct NewModerationBannedSession {
     pub session_id: String,
     /// Normalized keyword that fired.
     pub matched_keyword: String,
+    /// Risk-category codes of the keyword that fired.
+    pub matched_categories: Vec<String>,
     /// Context snippet around the hit.
     pub matched_context: String,
     /// Gateway endpoint.
diff --git a/crates/llm-access-core/src/store/traits.rs b/crates/llm-access-core/src/store/traits.rs
index ae459873..5ec7414c 100644
--- a/crates/llm-access-core/src/store/traits.rs
+++ b/crates/llm-access-core/src/store/traits.rs
@@ -35,8 +35,9 @@ use super::{
     },
     moderation::{
         ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
-        ModerationKeyword, ModerationKeywordImportOutcome, ModerationRuntimeSnapshot,
-        NewModerationBannedSession, NewModerationKeyword,
+        ModerationCategory, ModerationKeyword, ModerationKeywordImportOutcome,
+        ModerationRuntimeSnapshot, NewModerationBannedSession, NewModerationCategory,
+        NewModerationKeyword,
     },
     proxy::{
         AdminProxyBinding, AdminProxyConfig, AdminProxyConfigPatch, AdminProxyEndpointCheckUpdate,
@@ -289,10 +290,28 @@ pub trait AdminAnthropicUpstreamStore: Send + Sync {
 #[async_trait]
 pub trait AdminModerationStore: Send + Sync {
     /// Load the compact runtime snapshot consumed by the in-memory gate:
-    /// all keywords plus banned/allowlisted session keys.
+    /// all keywords (with their categories) plus banned/allowlisted session
+    /// keys.
     async fn load_moderation_runtime_snapshot(&self) -> anyhow::Result<ModerationRuntimeSnapshot>;
 
-    /// List all configured moderation keywords.
+    /// List all configured risk categories.
+    async fn list_moderation_categories(&self) -> anyhow::Result<Vec<ModerationCategory>>;
+
+    /// Insert categories in bulk, skipping ones whose code already exists.
+    async fn add_moderation_categories(
+        &self,
+        categories: Vec<NewModerationCategory>,
+    ) -> anyhow::Result<usize>;
+
+    /// Delete one category by code. Returns the deleted category when found.
+    /// Implementations should refuse deletion while keywords still reference
+    /// it.
+    async fn delete_moderation_category(
+        &self,
+        code: &str,
+    ) -> anyhow::Result<Option<ModerationCategory>>;
+
+    /// List all configured moderation keywords with their categories.
     async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>>;
 
     /// Insert keywords in bulk, skipping ones that already exist.
diff --git a/crates/llm-access-migrations/migrations/postgres/0037_moderation_categories.sql b/crates/llm-access-migrations/migrations/postgres/0037_moderation_categories.sql
new file mode 100644
index 00000000..c45c6a3b
--- /dev/null
+++ b/crates/llm-access-migrations/migrations/postgres/0037_moderation_categories.sql
@@ -0,0 +1,708 @@
+-- Keyword moderation risk categories.
+--
+-- Adds a category taxonomy and classifies keywords under it. A keyword may
+-- belong to several categories (category_codes is a JSONB array of codes), and
+-- a ban record captures the categories of the keyword that fired
+-- (matched_categories). Categories are managed separately from keywords so the
+-- taxonomy can grow without touching keyword rows.
+
+CREATE TABLE IF NOT EXISTS llm_moderation_categories (
+    code TEXT PRIMARY KEY CHECK (length(code) > 0),
+    label TEXT NOT NULL,
+    description TEXT NOT NULL DEFAULT '',
+    severity TEXT NOT NULL DEFAULT 'medium'
+        CHECK (severity IN ('critical', 'high', 'medium', 'low')),
+    created_at_ms BIGINT NOT NULL CHECK (created_at_ms >= 0)
+);
+
+ALTER TABLE llm_moderation_keywords
+    ADD COLUMN IF NOT EXISTS category_codes JSONB NOT NULL DEFAULT '[]'::jsonb;
+
+ALTER TABLE llm_moderation_banned_sessions
+    ADD COLUMN IF NOT EXISTS matched_categories JSONB NOT NULL DEFAULT '[]'::jsonb;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint
+        WHERE conname = 'ck_llm_moderation_keywords_category_codes_array'
+    ) THEN
+        ALTER TABLE llm_moderation_keywords
+            ADD CONSTRAINT ck_llm_moderation_keywords_category_codes_array
+            CHECK (jsonb_typeof(category_codes) = 'array');
+    END IF;
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_constraint
+        WHERE conname = 'ck_llm_moderation_banned_sessions_matched_categories_array'
+    ) THEN
+        ALTER TABLE llm_moderation_banned_sessions
+            ADD CONSTRAINT ck_llm_moderation_banned_sessions_matched_categories_array
+            CHECK (jsonb_typeof(matched_categories) = 'array');
+    END IF;
+END $$;
+
+-- GIN index so "which keywords reference category X" (delete guard) and
+-- category-filtered keyword queries stay fast as the keyword set grows.
+CREATE INDEX IF NOT EXISTS idx_llm_moderation_keywords_category_codes
+    ON llm_moderation_keywords USING gin (category_codes jsonb_path_ops);
+
+-- Seed the 11-category taxonomy (aligned to the OpenAI usage policy domains).
+INSERT INTO llm_moderation_categories (code, label, description, severity, created_at_ms) VALUES
+    ('csam', '儿童性内容 / Child sexual (CSAM)', 'Sexual content involving minors. Zero tolerance.', 'critical', 1704067200000),
+    ('sexual', '成人性内容 / Adult sexual (NSFW)', 'Adult pornographic or sexually explicit content.', 'high', 1704067200000),
+    ('weapons', '武器与危险物 / Weapons, explosives & CBRN', 'Weapons, explosives, firearms, and chemical/biological/radiological/nuclear materials.', 'critical', 1704067200000),
+    ('extremism', '暴力极端 / Violent extremism', 'Terrorism, mass-casualty attacks, violent extremism, and ethnic cleansing.', 'critical', 1704067200000),
+    ('drugs', '毒品制贩 / Illicit drugs', 'Manufacture, synthesis, or trafficking of illicit drugs.', 'high', 1704067200000),
+    ('criminal', '暴力犯罪与贩卖 / Violent crime & trafficking', 'Violence-for-hire, human/organ trafficking, and facilitation of real-world crimes.', 'critical', 1704067200000),
+    ('fraud', '欺诈与黑产 / Fraud & scams', 'Scams, money laundering, counterfeiting, phishing-as-fraud, and black-market operations.', 'high', 1704067200000),
+    ('cyber', '网络攻击与恶意软件 / Cybercrime & malware', 'Malware, ransomware, hacking, unauthorized access, credential theft, and exploits (OpenAI cyber policy).', 'high', 1704067200000),
+    ('piracy', '盗版破解与外挂 / Piracy, cracking & cheats', 'Software cracking, DRM/anti-cheat circumvention, and game cheats.', 'medium', 1704067200000),
+    ('self_harm', '自我伤害 / Self-harm & suicide', 'Suicide or self-harm methods and encouragement.', 'critical', 1704067200000),
+    ('jailbreak', '越狱与提示注入 / AI jailbreak', 'AI safety-bypass and prompt-injection attempts.', 'medium', 1704067200000)
+ON CONFLICT (code) DO NOTHING;
+
+-- Seed the classified keyword blocklist (generated; see the moderation seed).
+INSERT INTO llm_moderation_keywords (keyword, source, category_codes, created_at_ms) VALUES
+    ('child porn', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('child pornography', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('underage porn', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('underage sex video', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('preteen sex', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('toddler porn', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('infant porn', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('minor nude photo', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('pedophile guide', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('how to groom a child', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('loli sex', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('shota sex', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('lolicon', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('shotacon', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('underage roleplay sexual', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('儿 童 色 情', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('幼 女 性 交', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('幼 童 裸 照', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('未 成 年 性 视 频', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('未 成 年 性 描 写', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('幼 女 色 情', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('幼 女 性 描 写', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('萝 莉 色 情', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('萝 莉 性 描 写', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('正 太 色 情', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('how to make a bomb', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('build a pipe bomb', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('pressure cooker bomb', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('homemade explosive recipe', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('ied construction', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('tatp synthesis', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('detonator wiring', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('nerve agent synthesis', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('sarin gas production', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('mustard gas recipe', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('weaponize anthrax', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('ricin extraction', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('chlorine gas weapon', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('dirty bomb design', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('制 造 炸 弹', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('炸 药 配 方', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('自 制 爆 炸 物', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('沙 林 毒 气 制 作', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('生 化 武 器 制 造', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('蓖 麻 毒 素 提 取', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('ghost gun build', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('3d printed firearm files', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('untraceable gun', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('自 制 枪 支', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('枪 支 改 造 教 程', 'txt', '["weapons"]'::jsonb, 1704067200000),
+    ('mass shooting plan', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('school shooting plan', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('how to plan an attack on', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('maximize casualties', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('terrorist recruitment', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('ethnic cleansing', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('校 园 枪 击 计 划', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('恐 怖 组 织 招 募', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('种 族 清 洗', 'txt', '["extremism"]'::jsonb, 1704067200000),
+    ('methamphetamine synthesis', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('how to make meth', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('fentanyl synthesis', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('mdma synthesis', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('drug lab setup', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('dark web drug vendor', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('制 毒 方 法', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('冰 毒', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('芬 太 尼 合 成', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('摇 头 丸 制 作', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('hire a hitman', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('human trafficking', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('organ trafficking', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('雇 凶 杀 人', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('买 凶 杀 人', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('人 口 贩 卖', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('器 官 买 卖', 'txt', '["criminal"]'::jsonb, 1704067200000),
+    ('money laundering method', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('how to launder money', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('romance scam script', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('fake investment platform', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('counterfeit currency printing', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('ponzi scheme setup', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('carding tutorial', 'txt', '["fraud","cyber"]'::jsonb, 1704067200000),
+    ('信 用 卡 盗 刷 教 程', 'txt', '["fraud","cyber"]'::jsonb, 1704067200000),
+    ('洗 钱 渠 道', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('电 信 诈 骗 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('杀 猪 盘 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('假 币 制 作', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('ransomware source code', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('build a ransomware', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('write a keylogger', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('remote access trojan code', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('botnet command and control', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('credential stuffing tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('credential stuffing attack', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('phishing kit download', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('phishing page source', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('0day exploit for sale', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('atm skimmer build', 'txt', '["cyber","fraud"]'::jsonb, 1704067200000),
+    ('account cracker tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('account credential theft', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('brute force password tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('brute force password crack', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('password cracking tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('rainbow table crack', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('hash cracking tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('wifi hacking tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('hack someone s account', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('sql injection to hack', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('unauthorized access tool', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('privilege escalation exploit', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('root exploit code', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('reverse shell exploit', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('webshell backdoor', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('webshell upload', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('撞 库 脚 本', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('撞 库 攻 击', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('盗 号 木 马', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('盗 号 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('盗 号 软 件', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('账 号 盗 取 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('盗 取 他 人 账 号', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('入 侵 他 人 网 站', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('勒 索 病 毒 源 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('勒 索 病 毒 制 作', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('钓 鱼 网 站 源 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('钓 鱼 源 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('钓 鱼 页 面 制 作', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('木 马 病 毒 制 作', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('键 盘 记 录 木 马', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('远 程 控 制 木 马', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('蠕 虫 病 毒 代 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('后 门 程 序 安 装', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('暴 力 破 解 密 码', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('密 码 爆 破 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('免 杀 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('免 杀 马', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('root 提 权 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('提 权 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('提 权 漏 洞 利 用', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('脱 壳 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('砸 壳 脱 壳', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('协 议 逆 向 破 解', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('内 存 抓 取 工 具', 'txt', '["cyber"]'::jsonb, 1704067200000),
+    ('software cracking tool', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('crack license key', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('bypass license verification', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('bypass license check', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('keygen for', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('keygen crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('serial number crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('activation crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('nulled software', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('pirated software download', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('warez download', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('drm bypass', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('drm removal tool', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('注 册 机', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('注 册 机 下 载', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('软 件 破 解 教 程', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('破 解 补 丁', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('序 列 号 破 解', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('外 挂 软 件', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 透 视 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 自 瞄 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('自 瞄 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('外 挂 注 入', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('代 码 注 入 外 挂', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('外 挂 制 作 教 程', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 内 存 修 改', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('封 包 修 改 工 具', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('aimbot', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('wallhack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('maphack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('cheat engine hack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('game trainer cheat', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('speed hack game', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('aim assist hack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('no recoil hack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('god mode cheat', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('unlimited ammo cheat', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('painless suicide method', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('most lethal way to kill myself', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('lethal dose to die', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('无 痛 自 杀 方 法', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('烧 炭 自 杀 教 程', 'txt', '["self_harm"]'::jsonb, 1704067200000),
+    ('dan jailbreak', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('jailbreak prompt nsfw', 'txt', '["jailbreak","sexual"]'::jsonb, 1704067200000),
+    ('uncensored ai mode', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('ignore safety guidelines nsfw', 'txt', '["jailbreak","sexual"]'::jsonb, 1704067200000),
+    ('write explicit sex scene', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('write graphic sex scene', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('write porn story', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('generate nude image', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('generate explicit content', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('generate hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('generate nsfw content', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('adult content generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('explicit content generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nsfw image generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('explicit image generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude image generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pornographic image generation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('child sex', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('blowjob', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('handjob', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cumshot', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('creampie', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('deepthroat', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('gangbang', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('bukkake', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('oral sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('anal sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('doggystyle', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cunnilingus', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('fellatio', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('masturbation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dildo', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('butt plug', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('clitoris', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ejaculation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('threesome', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('bdsm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dominatrix', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('footjob', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rimjob', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('golden shower', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ahegao', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('futanari', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nakadashi', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pornography', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('porn video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex tape', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude selfie', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude photo', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('xxx video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('adult film', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cam girl', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('prostitution', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex doll', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('fleshlight', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('vaginal sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('penile penetration', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual intercourse', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('breast fondling', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple sucking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy eating', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy licking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cock sucking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dick sucking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('double penetration', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('fisting sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('squirting orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('facial cumshot', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cum inside', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cum on face', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cum swallow', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erect penis', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('wet vagina', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy fingering', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ass penetration', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cock and ball torture', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple torture', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple clamp', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rope bondage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('wax play', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex slave', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex dungeon', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('shibari bondage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pegging sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('strapon sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cuckold sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('voyeur video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('public sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('glory hole', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex party', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('swinger sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('milf porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('teen porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('amateur porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('homemade porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('incest roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('step sister sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('step brother sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('step mom sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('step dad sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('taboo sex roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ruined orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('forced orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic massage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('happy ending massage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nuru massage', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('striptease nude', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pornstar', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cybersex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('phone sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexting nude', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dick pic', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy pic', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('lewd roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('smut writing', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic fiction', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual fanfic', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('furry porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('yiff', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rule34', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('anime porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('manga porn', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('hentai manga', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('hentai video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('uncensored hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('tentacle hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('monster sex hentai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('bestiality', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('zoophilia', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rape fantasy', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('rape roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('non consent sex roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('forced sex roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual violence roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('drugged sex', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('sex blackmail', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('erotic hypnosis', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('incest sex story', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('family sex roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic audio', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nsfw audio', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('write erotic content', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('write sexual content', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('做 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('肛 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('龟 头', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('爱 液', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('潮 吹', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('潮 喷', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('自 慰', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('手 淫', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 爆', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('内 射', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('颜 射', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('足 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('群 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('轮 奸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('强 奸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阳 具', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 唇', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 蒂', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 道', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 茎', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 头', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 房', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('生 殖 器', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 器 官', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('射 精', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 道 哑 铃', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('月 经 自 由', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 道 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 茎 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('私 处 展 示', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 侵', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乱 伦', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('腋 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('脚 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 奴', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('约 炮', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('炮 友', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('嫖 娼', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('卖 淫', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 交 易', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('换 妻', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 虐 待', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('迷 奸 描 写', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('下 药 侵 犯', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('迷 药 性 爱', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('性 胁 迫', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('强 制 性 交', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('强 迫 性 爱 描 写', 'txt', '["sexual","criminal"]'::jsonb, 1704067200000),
+    ('淫 荡 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('淫 秽 内 容', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('淫 秽 图 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('淫 秽 视 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 视 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 图 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 故 事', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 视 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 故 事', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 聊 天', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 自 拍', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('成 人 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('淫 乱 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('裸 照', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('私 房 照', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('私 处 照 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('不 雅 视 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('全 裸 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('裸 体 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('裸 体 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('偷 拍 裸 体', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('偷 窥 色 情', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('露 出 癖', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('摸 奶', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('揉 奶', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('舔 奶', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('摸 胸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('揉 胸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('舔 胸', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('肛 塞', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('飞 机 杯', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('按 摩 棒', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('振 动 棒', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('跳 蛋', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('充 气 娃 娃', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('援 助 交 际', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('卖 淫 嫖 娼', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('开 房 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 派 对', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 交 吞 精', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('吞 精 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('深 喉 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('多 人 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('集 体 性 爱 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('捆 绑 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('鞭 打 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('调 教 性 爱', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 描 写 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('露 骨 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 剧 情', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('母 子 乱 伦', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('父 女 乱 伦', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('兄 妹 乱 伦', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('亲 子 性 爱 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('撸 管 教 程', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('成 人 网 站 推 荐', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 网 站', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('av 女 优', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('无 码 av', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('三 级 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 文 学', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 文 学', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('写 色 情 小 说', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('生 成 色 情 图 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('写 性 爱 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('生 成 裸 体 图 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('写 露 骨 内 容', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('ai 色 情 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('刷 单', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('刷 好 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('刷 差 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('虚 假 好 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('虚 假 评 论', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 好 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('水 军', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('网 络 水 军', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('养 号', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 注 册 账 号', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('接 码 平 台', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('群 发 广 告', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('裸 聊 敲 诈', 'txt', '["fraud","sexual"]'::jsonb, 1704067200000),
+    ('裸 聊 勒 索', 'txt', '["fraud","sexual"]'::jsonb, 1704067200000),
+    ('引 流 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('拉 人 头 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('赌 博 网 站 推 广', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('博 彩 推 广', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('菠 菜 推 广', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('色 流 引 流', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('黑 卡 盗 刷', 'txt', '["fraud","cyber"]'::jsonb, 1704067200000),
+    ('四 件 套 买 卖', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('跑 分 洗 钱', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('虚 拟 币 跑 分', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('冒 充 客 服 诈 骗', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('冒 充 公 检 法', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('贷 款 诈 骗 话 术', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('刷 单 返 利 诈 骗', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('兼 职 刷 单 诈 骗', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('注 销 校 园 贷', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('钓 鱼 短 信 模 板', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('诈 骗 短 信 模 板', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('诈 骗 话 术 生 成', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('营 销 软 文 代 写', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('软 文 代 写', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('书 评 生 成', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 书 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 生 成 书 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('代 写 书 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('刷 书 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('书 评 水 军', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('代 写 好 评', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 营 销 文 案', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('营 销 号 文 案 批 量', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('批 量 软 文 生 成', 'txt', '["fraud"]'::jsonb, 1704067200000),
+    ('越 狱 提 示 词', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('破 限 提 示 词', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('绕 过 道 德 限 制', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('绕 过 内 容 审 核', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('绕 过 安 全 限 制', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('解 除 限 制 模 式', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('忽 略 系 统 提 示', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('忽 略 之 前 的 指 令', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('忽 略 以 上 所 有 指 令', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('ignore previous instructions', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('ignore all previous instructions', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('disregard your guidelines', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('disregard previous instructions', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('developer mode enabled', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('do anything now', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('stay in character as', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('roleplay as an unrestricted ai', 'txt', '["jailbreak"]'::jsonb, 1704067200000),
+    ('drm crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('drm removal', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('bypass drm protection', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('crack download', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('license crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('license keygen', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('软 件 crack', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('软 件 破 解 版', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('破 解 软 件', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('破 解 软 件 授 权', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('激 活 码 破 解', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('越 狱 破 解', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('逆 向 授 权 绕 过', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('绕 过 激 活 验 证', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('绕 过 反 作 弊', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('activation lock bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('icloud bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('mdm bypass exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('frida jailbreak bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('ssl pinning bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('jailbreak bypass tool', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('anti cheat bypass', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('eac bypass', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('battleye bypass', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('easy anti cheat bypass', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('anti debug bypass', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('bootloader unlock exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('magisk root exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('firmware dump exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('rom dump tool', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('memory dumping tool', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('process injection exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('code injection exploit', 'txt', '["cyber","piracy"]'::jsonb, 1704067200000),
+    ('dll injection cheat', 'txt', '["piracy","cyber"]'::jsonb, 1704067200000),
+    ('aimbot download', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('wallhack cheat', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('esp hack game', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('game cheat engine', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('game memory editor', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 外 挂 制 作', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('游 戏 破 解 版 下 载', 'txt', '["piracy"]'::jsonb, 1704067200000),
+    ('sm 道 具', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('airtight gangbang', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('bondage sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('breast licking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('breast sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cam show', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('clitoral stimulation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cock riding', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cock worship', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('cum tribute', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('dick riding', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('doujinshi nsfw', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('edging orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('erotic roleplay ai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('exhibitionism sexual', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('explicit video', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('foot fetish explicit', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('g spot stimulation', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('hard penis', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('jailbreak nsfw', 'txt', '["jailbreak","sexual"]'::jsonb, 1704067200000),
+    ('lactation fetish', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('lewd ai roleplay', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('multiple orgasm', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple licking', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nipple play', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude exchange', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('nude modeling explicit', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('onlyfans leak', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('orgy', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('outdoor sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('panty fetish sexual', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('porn actress', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pornographic story', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('prostate stimulation sexual', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy juice', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('pussy worship', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('semen swallow', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sex roleplay ai', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('sexual climax', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('spitroast sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('strap on sex', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('tit job', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('vaginal lubrication', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('vaginal penetration', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('vibrator', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('上 床 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 头 夹', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('乳 头 虐 待', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('冰 毒 制 作', 'txt', '["drugs"]'::jsonb, 1704067200000),
+    ('前 列 腺 按 摩 性', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('勃 起 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 交 口 爆', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('口 腔 性 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('后 入 体 位', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 刺 激 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 服 务', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 剧 情', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 无 码', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 机 器 人', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 爱 音 频 生 成', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 玩 具 使 用', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('性 高 潮', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('情 色 电 影 推 荐', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('成 人 影 片', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('手 淫 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('抽 插 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('无 套 内 射', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('无 套 性 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('有 码 av', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('精 液 吞 咽', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('肉 欲 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('肛 门 性 交', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('胸 部 展 示 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('自 慰 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 无 码', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('色 情 音 频', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('萝 莉 色 情 视 频', 'txt', '["csam"]'::jsonb, 1704067200000),
+    ('阴 毛', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('阴 道 扩 张', 'txt', '["sexual"]'::jsonb, 1704067200000),
+    ('骑 乘 位 描 写', 'txt', '["sexual"]'::jsonb, 1704067200000)
+ON CONFLICT (keyword) DO NOTHING;
diff --git a/crates/llm-access-migrations/src/lib.rs b/crates/llm-access-migrations/src/lib.rs
index 611e3dbb..503ae819 100644
--- a/crates/llm-access-migrations/src/lib.rs
+++ b/crates/llm-access-migrations/src/lib.rs
@@ -188,6 +188,11 @@ const POSTGRES_MIGRATIONS: &[SqlMigration] = &[
         name: "keyword_moderation",
         sql: include_str!("../migrations/postgres/0036_keyword_moderation.sql"),
     },
+    SqlMigration {
+        version: 37,
+        name: "moderation_categories",
+        sql: include_str!("../migrations/postgres/0037_moderation_categories.sql"),
+    },
 ];
 
 /// Return target DuckDB migrations in execution order.
diff --git a/crates/llm-access-store/src/postgres.rs b/crates/llm-access-store/src/postgres.rs
index 2c63289c..029784e9 100644
--- a/crates/llm-access-store/src/postgres.rs
+++ b/crates/llm-access-store/src/postgres.rs
@@ -788,8 +788,8 @@ mod tests {
             AdminKiroAccountStore, AdminModerationStore, AdminPageRequest, AdminProxyConfigPatch,
             AdminProxyStore, AdminProxyTrafficSnapshot, AdminReviewQueueStore,
             AnthropicUpstreamChannelUsageDelta, ControlStore, KeyUsageRollupDelta,
-            NewAdminAnthropicUpstreamChannel, NewAdminProxyConfig,
-            NewModerationBannedSession, NewModerationKeyword, NewPublicAccountContributionRequest,
+            NewAdminAnthropicUpstreamChannel, NewAdminProxyConfig, NewModerationBannedSession,
+            NewModerationCategory, NewModerationKeyword, NewPublicAccountContributionRequest,
             ProviderRouteStore, ProxyTrafficTotals, PublicSubmissionStore, PublicUsageStore,
             UsageEventSink, UsageRollupBatch, UsageRollupBatchSink,
         },
@@ -849,6 +849,7 @@ mod tests {
                 "TRUNCATE TABLE
                     llm_moderation_banned_sessions,
                     llm_moderation_keywords,
+                    llm_moderation_categories,
                     llm_account_import_job_items,
                     llm_account_import_jobs,
                     llm_codex_status_cache,
@@ -2004,24 +2005,63 @@ mod tests {
 
         let now = 1_700_000_000_000;
 
-        // Bulk keyword insert: exercises the UNNEST array binding, the
-        // NULLIF(note, '') coercion, and ON CONFLICT dedup within one batch.
+        // Categories: bulk insert + code conflict dedup.
+        let category_inserted = repo
+            .add_moderation_categories(vec![
+                NewModerationCategory {
+                    code: "weapons".to_string(),
+                    label: "Weapons".to_string(),
+                    description: "Weapons and explosives.".to_string(),
+                    severity: "critical".to_string(),
+                    created_at_ms: now,
+                },
+                NewModerationCategory {
+                    code: "fraud".to_string(),
+                    label: "Fraud".to_string(),
+                    description: String::new(),
+                    severity: "high".to_string(),
+                    created_at_ms: now,
+                },
+                NewModerationCategory {
+                    code: "weapons".to_string(),
+                    label: "dup".to_string(),
+                    description: String::new(),
+                    severity: "low".to_string(),
+                    created_at_ms: now,
+                },
+            ])
+            .await
+            .expect("add moderation categories");
+        assert_eq!(category_inserted, 2);
+        assert_eq!(
+            repo.list_moderation_categories()
+                .await
+                .expect("list categories")
+                .len(),
+            2
+        );
+
+        // Bulk keyword insert with categories: exercises the UNNEST array
+        // binding, NULLIF(note, ''), category_codes JSONB, and ON CONFLICT dedup.
         let outcome = repo
             .add_moderation_keywords(vec![
                 NewModerationKeyword {
                     keyword: "build a bomb".to_string(),
+                    categories: vec!["weapons".to_string()],
                     note: Some("danger".to_string()),
                     source: "txt".to_string(),
                     created_at_ms: now,
                 },
                 NewModerationKeyword {
                     keyword: "free phrase".to_string(),
+                    categories: Vec::new(),
                     note: None,
                     source: "json".to_string(),
                     created_at_ms: now,
                 },
                 NewModerationKeyword {
                     keyword: "build a bomb".to_string(),
+                    categories: vec!["weapons".to_string()],
                     note: None,
                     source: "txt".to_string(),
                     created_at_ms: now,
@@ -2036,6 +2076,7 @@ mod tests {
         let repeat = repo
             .add_moderation_keywords(vec![NewModerationKeyword {
                 keyword: "build a bomb".to_string(),
+                categories: vec!["weapons".to_string()],
                 note: None,
                 source: "txt".to_string(),
                 created_at_ms: now,
@@ -2055,11 +2096,24 @@ mod tests {
             .find(|keyword| keyword.keyword == "build a bomb")
             .expect("bomb keyword present");
         assert_eq!(bomb.note.as_deref(), Some("danger"));
+        assert_eq!(bomb.categories, vec!["weapons".to_string()]);
         let free = keywords
             .iter()
             .find(|keyword| keyword.keyword == "free phrase")
             .expect("free keyword present");
         assert_eq!(free.note, None);
+        assert!(free.categories.is_empty());
+
+        // A referenced category cannot be deleted; an unreferenced one can.
+        assert!(repo.delete_moderation_category("weapons").await.is_err());
+        assert_eq!(
+            repo.delete_moderation_category("fraud")
+                .await
+                .expect("delete unreferenced category")
+                .expect("deleted category")
+                .code,
+            "fraud"
+        );
 
         // Delete: RETURNING yields the removed row; a second delete is a no-op.
         let deleted = repo
@@ -2088,6 +2142,7 @@ mod tests {
             key_name: "external".to_string(),
             session_id: "sess-1".to_string(),
             matched_keyword: "build a bomb".to_string(),
+            matched_categories: vec!["weapons".to_string()],
             matched_context: "…how to build a bomb now…".to_string(),
             endpoint: "/v1/messages".to_string(),
             model: "claude-sonnet-4".to_string(),
@@ -2121,7 +2176,13 @@ mod tests {
             .expect("record second banned session"));
 
         let banned = repo
-            .list_moderation_banned_sessions(AdminPageRequest { limit: 10, offset: 0 }, Some("banned"))
+            .list_moderation_banned_sessions(
+                AdminPageRequest {
+                    limit: 10,
+                    offset: 0,
+                },
+                Some("banned"),
+            )
             .await
             .expect("list banned sessions");
         assert_eq!(banned.total, 2);
@@ -2139,10 +2200,16 @@ mod tests {
             .expect("banned session detail present");
         assert!(detail.request_body_json.contains("how to build a bomb"));
         assert!(detail.request_headers_json.contains("<redacted>"));
+        assert_eq!(detail.session.matched_categories, vec!["weapons".to_string()]);
 
         // Review flow: unban records the note and flips the status filters.
         let updated = repo
-            .set_moderation_banned_session_status(target.id, "unbanned", Some("false positive"), now + 1)
+            .set_moderation_banned_session_status(
+                target.id,
+                "unbanned",
+                Some("false positive"),
+                now + 1,
+            )
             .await
             .expect("review banned session")
             .expect("reviewed session present");
@@ -2151,13 +2218,22 @@ mod tests {
         assert_eq!(updated.reviewed_at_ms, Some(now + 1));
 
         let still_banned = repo
-            .list_moderation_banned_sessions(AdminPageRequest { limit: 10, offset: 0 }, Some("banned"))
+            .list_moderation_banned_sessions(
+                AdminPageRequest {
+                    limit: 10,
+                    offset: 0,
+                },
+                Some("banned"),
+            )
             .await
             .expect("list still-banned sessions");
         assert_eq!(still_banned.total, 1);
         let unbanned = repo
             .list_moderation_banned_sessions(
-                AdminPageRequest { limit: 10, offset: 0 },
+                AdminPageRequest {
+                    limit: 10,
+                    offset: 0,
+                },
                 Some("unbanned"),
             )
             .await
diff --git a/crates/llm-access-store/src/postgres/moderation.rs b/crates/llm-access-store/src/postgres/moderation.rs
index c40ff463..a881885e 100644
--- a/crates/llm-access-store/src/postgres/moderation.rs
+++ b/crates/llm-access-store/src/postgres/moderation.rs
@@ -5,18 +5,43 @@ use anyhow::Context;
 use async_trait::async_trait;
 use llm_access_core::store::{
     AdminModerationStore, AdminPageRequest, ModerationBannedSession, ModerationBannedSessionDetail,
-    ModerationBannedSessionsPage, ModerationKeyword, ModerationKeywordImportOutcome,
-    ModerationRuntimeSnapshot, NewModerationBannedSession, NewModerationKeyword,
-    MODERATION_SESSION_STATUS_BANNED, MODERATION_SESSION_STATUS_UNBANNED,
+    ModerationBannedSessionsPage, ModerationCategory, ModerationKeyword,
+    ModerationKeywordImportOutcome, ModerationRuntimeSnapshot, NewModerationBannedSession,
+    NewModerationCategory, NewModerationKeyword, MODERATION_SESSION_STATUS_BANNED,
+    MODERATION_SESSION_STATUS_UNBANNED,
 };
 
 use super::{now_ms, PgRow, PostgresControlRepository};
 
-const MODERATION_KEYWORD_COLUMNS: &str = "id, keyword, note, source, created_at_ms";
+const MODERATION_CATEGORY_COLUMNS: &str = "code, label, description, severity, created_at_ms";
+
+const MODERATION_KEYWORD_COLUMNS: &str =
+    "id, keyword, note, source, created_at_ms, category_codes::text";
 
 const MODERATION_BANNED_SESSION_COLUMNS: &str =
     "id, session_key, provider, key_id, key_name, session_id, matched_keyword, matched_context, \
-     endpoint, model, client_ip, status, review_note, banned_at_ms, reviewed_at_ms, updated_at_ms";
+     endpoint, model, client_ip, status, review_note, banned_at_ms, reviewed_at_ms, \
+     updated_at_ms, matched_categories::text";
+
+/// Decode a JSONB text-array column (e.g. `["csam","cyber"]`) into codes. A
+/// malformed value degrades to an empty list rather than failing the row.
+fn category_codes_from_json_text(raw: String) -> Vec<String> {
+    serde_json::from_str::<Vec<String>>(&raw).unwrap_or_default()
+}
+
+fn category_codes_to_json(codes: &[String]) -> String {
+    serde_json::to_string(codes).unwrap_or_else(|_| "[]".to_string())
+}
+
+fn moderation_category_from_row(row: &PgRow) -> ModerationCategory {
+    ModerationCategory {
+        code: row.get(0),
+        label: row.get(1),
+        description: row.get(2),
+        severity: row.get(3),
+        created_at_ms: row.get(4),
+    }
+}
 
 fn moderation_keyword_from_row(row: &PgRow) -> ModerationKeyword {
     ModerationKeyword {
@@ -25,6 +50,7 @@ fn moderation_keyword_from_row(row: &PgRow) -> ModerationKeyword {
         note: row.get(2),
         source: row.get(3),
         created_at_ms: row.get(4),
+        categories: category_codes_from_json_text(row.get(5)),
     }
 }
 
@@ -46,6 +72,7 @@ fn moderation_banned_session_from_row(row: &PgRow) -> ModerationBannedSession {
         banned_at_ms: row.get(13),
         reviewed_at_ms: row.get(14),
         updated_at_ms: row.get(15),
+        matched_categories: category_codes_from_json_text(row.get(16)),
     }
 }
 
@@ -86,6 +113,95 @@ impl AdminModerationStore for PostgresControlRepository {
         })
     }
 
+    async fn list_moderation_categories(&self) -> anyhow::Result<Vec<ModerationCategory>> {
+        self.ensure_connection_alive()?;
+        let sql = format!(
+            "SELECT {MODERATION_CATEGORY_COLUMNS} FROM llm_moderation_categories ORDER BY code"
+        );
+        let rows = self
+            .client
+            .query(&sql, &[])
+            .await
+            .context("list postgres moderation categories")?;
+        Ok(rows.iter().map(moderation_category_from_row).collect())
+    }
+
+    async fn add_moderation_categories(
+        &self,
+        categories: Vec<NewModerationCategory>,
+    ) -> anyhow::Result<usize> {
+        self.ensure_connection_alive()?;
+        if categories.is_empty() {
+            return Ok(0);
+        }
+        let total = categories.len();
+        let mut code_values = Vec::with_capacity(total);
+        let mut label_values = Vec::with_capacity(total);
+        let mut description_values = Vec::with_capacity(total);
+        let mut severity_values = Vec::with_capacity(total);
+        let mut created_at_values = Vec::with_capacity(total);
+        for category in categories {
+            code_values.push(category.code);
+            label_values.push(category.label);
+            description_values.push(category.description);
+            severity_values.push(category.severity);
+            created_at_values.push(category.created_at_ms);
+        }
+        let inserted = self
+            .client
+            .execute(
+                "INSERT INTO llm_moderation_categories (code, label, description, severity, \
+                 created_at_ms)
+                 SELECT code, label, description, severity, created_at_ms
+                 FROM UNNEST($1::text[], $2::text[], $3::text[], $4::text[], $5::bigint[])
+                     AS input(code, label, description, severity, created_at_ms)
+                 ON CONFLICT (code) DO NOTHING",
+                &[
+                    &code_values,
+                    &label_values,
+                    &description_values,
+                    &severity_values,
+                    &created_at_values,
+                ],
+            )
+            .await
+            .context("insert postgres moderation categories")?;
+        Ok(inserted as usize)
+    }
+
+    async fn delete_moderation_category(
+        &self,
+        code: &str,
+    ) -> anyhow::Result<Option<ModerationCategory>> {
+        self.ensure_connection_alive()?;
+        // Refuse deletion while any keyword still references the category, so a
+        // keyword can never point at a dangling code.
+        let referenced: bool = self
+            .client
+            .query_one(
+                "SELECT EXISTS(
+                    SELECT 1 FROM llm_moderation_keywords WHERE category_codes ? $1
+                )",
+                &[&code],
+            )
+            .await
+            .context("check postgres moderation category references")?
+            .get(0);
+        if referenced {
+            anyhow::bail!("category `{code}` is still referenced by one or more keywords");
+        }
+        let sql = format!(
+            "DELETE FROM llm_moderation_categories WHERE code = $1
+             RETURNING {MODERATION_CATEGORY_COLUMNS}"
+        );
+        let row = self
+            .client
+            .query_opt(&sql, &[&code])
+            .await
+            .context("delete postgres moderation category")?;
+        Ok(row.as_ref().map(moderation_category_from_row))
+    }
+
     async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>> {
         self.ensure_connection_alive()?;
         let sql = format!(
@@ -111,22 +227,31 @@ impl AdminModerationStore for PostgresControlRepository {
         let mut keyword_values = Vec::with_capacity(total);
         let mut note_values = Vec::with_capacity(total);
         let mut source_values = Vec::with_capacity(total);
+        let mut category_values = Vec::with_capacity(total);
         let mut created_at_values = Vec::with_capacity(total);
         for keyword in keywords {
             keyword_values.push(keyword.keyword);
             note_values.push(keyword.note.unwrap_or_default());
             source_values.push(keyword.source);
+            category_values.push(category_codes_to_json(&keyword.categories));
             created_at_values.push(keyword.created_at_ms);
         }
         let inserted = self
             .client
             .execute(
-                "INSERT INTO llm_moderation_keywords (keyword, note, source, created_at_ms)
-                 SELECT keyword, NULLIF(note, ''), source, created_at_ms
-                 FROM UNNEST($1::text[], $2::text[], $3::text[], $4::bigint[])
-                     AS input(keyword, note, source, created_at_ms)
+                "INSERT INTO llm_moderation_keywords (keyword, note, source, category_codes, \
+                 created_at_ms)
+                 SELECT keyword, NULLIF(note, ''), source, category_codes::jsonb, created_at_ms
+                 FROM UNNEST($1::text[], $2::text[], $3::text[], $4::text[], $5::bigint[])
+                     AS input(keyword, note, source, category_codes, created_at_ms)
                  ON CONFLICT (keyword) DO NOTHING",
-                &[&keyword_values, &note_values, &source_values, &created_at_values],
+                &[
+                    &keyword_values,
+                    &note_values,
+                    &source_values,
+                    &category_values,
+                    &created_at_values,
+                ],
             )
             .await
             .context("insert postgres moderation keywords")? as usize;
@@ -174,12 +299,13 @@ impl AdminModerationStore for PostgresControlRepository {
                     client_ip,
                     request_headers_json,
                     request_body_json,
+                    matched_categories,
                     status,
                     banned_at_ms,
                     updated_at_ms
                  )
                  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
-                         'banned', $13, $13)
+                         $13::jsonb, 'banned', $14, $14)
                  ON CONFLICT (session_key) DO NOTHING",
                 &[
                     &record.session_key,
@@ -194,6 +320,7 @@ impl AdminModerationStore for PostgresControlRepository {
                     &record.client_ip,
                     &record.request_headers_json,
                     &record.request_body_json,
+                    &category_codes_to_json(&record.matched_categories),
                     &record.banned_at_ms,
                 ],
             )
@@ -294,8 +421,8 @@ impl AdminModerationStore for PostgresControlRepository {
         };
         Ok(Some(ModerationBannedSessionDetail {
             session: moderation_banned_session_from_row(&row),
-            request_headers_json: row.get(16),
-            request_body_json: row.get(17),
+            request_headers_json: row.get(17),
+            request_body_json: row.get(18),
         }))
     }
 
diff --git a/crates/llm-access/src/admin.rs b/crates/llm-access/src/admin.rs
index 8e5462a3..93d03798 100644
--- a/crates/llm-access/src/admin.rs
+++ b/crates/llm-access/src/admin.rs
@@ -3100,6 +3100,10 @@ pub(crate) struct AddAdminModerationKeywordsRequest {
     /// Optional shared note applied to every imported keyword.
     #[serde(default)]
     note: Option<String>,
+    /// Risk-category codes applied to every keyword in this import (must be
+    /// codes that already exist in the category taxonomy).
+    #[serde(default)]
+    categories: Vec<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -3110,6 +3114,133 @@ struct AddAdminModerationKeywordsResponse {
     generated_at: i64,
 }
 
+#[derive(Debug, Serialize)]
+struct AdminModerationCategoriesResponse {
+    categories: Vec<core_store::ModerationCategory>,
+    generated_at: i64,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct AddAdminModerationCategoriesRequest {
+    categories: Vec<AdminModerationCategoryInput>,
+}
+
+#[derive(Debug, Deserialize)]
+struct AdminModerationCategoryInput {
+    code: String,
+    label: String,
+    #[serde(default)]
+    description: Option<String>,
+    #[serde(default)]
+    severity: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+struct AddAdminModerationCategoriesResponse {
+    inserted: usize,
+    generated_at: i64,
+}
+
+pub(crate) async fn list_admin_moderation_categories(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .list_moderation_categories()
+        .await
+    {
+        Ok(categories) => Json(AdminModerationCategoriesResponse {
+            categories,
+            generated_at: now_ms(),
+        })
+        .into_response(),
+        Err(_) => internal_error("Failed to list moderation categories").into_response(),
+    }
+}
+
+pub(crate) async fn add_admin_moderation_categories(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Json(request): Json<AddAdminModerationCategoriesRequest>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    if request.categories.is_empty() {
+        return bad_request("no categories were provided").into_response();
+    }
+    let created_at_ms = now_ms();
+    let mut records = Vec::with_capacity(request.categories.len());
+    for input in request.categories {
+        let code = input.code.trim().to_ascii_lowercase();
+        if code.is_empty() || !code.chars().all(|c| c.is_ascii_alphanumeric() || c == '_') {
+            return bad_request(
+                "category code must be non-empty and use only [a-z0-9_] characters",
+            )
+            .into_response();
+        }
+        let label = input.label.trim().to_string();
+        if label.is_empty() {
+            return bad_request("category label must not be empty").into_response();
+        }
+        let severity = input
+            .severity
+            .as_deref()
+            .map(str::trim)
+            .map(str::to_ascii_lowercase)
+            .unwrap_or_else(|| core_store::MODERATION_CATEGORY_SEVERITY_MEDIUM.to_string());
+        if !matches!(severity.as_str(), "critical" | "high" | "medium" | "low") {
+            return bad_request("severity must be one of critical/high/medium/low").into_response();
+        }
+        records.push(core_store::NewModerationCategory {
+            code,
+            label,
+            description: input.description.unwrap_or_default().trim().to_string(),
+            severity,
+            created_at_ms,
+        });
+    }
+    match state
+        .admin_moderation_store
+        .add_moderation_categories(records)
+        .await
+    {
+        Ok(inserted) => Json(AddAdminModerationCategoriesResponse {
+            inserted,
+            generated_at: now_ms(),
+        })
+        .into_response(),
+        Err(_) => internal_error("Failed to add moderation categories").into_response(),
+    }
+}
+
+pub(crate) async fn delete_admin_moderation_category(
+    State(state): State<HttpState>,
+    headers: HeaderMap,
+    Path(code): Path<String>,
+) -> Response {
+    if let Err(response) = ensure_admin_access(&headers) {
+        return response.into_response();
+    }
+    match state
+        .admin_moderation_store
+        .delete_moderation_category(&code)
+        .await
+    {
+        Ok(Some(category)) => Json(DeleteResponse {
+            deleted: true,
+            id: category.code,
+        })
+        .into_response(),
+        Ok(None) => not_found("Moderation category not found").into_response(),
+        Err(err) => conflict(&err.to_string()).into_response(),
+    }
+}
+
 #[derive(Debug, Serialize)]
 struct AdminModerationBannedSessionsResponse {
     sessions: Vec<core_store::ModerationBannedSession>,
@@ -3207,6 +3338,38 @@ pub(crate) async fn add_admin_moderation_keywords(
         ))
         .into_response();
     }
+    // Normalize + validate the batch-level categories against the taxonomy so a
+    // keyword can never reference a category that does not exist.
+    let mut categories: Vec<String> = request
+        .categories
+        .iter()
+        .map(|code| code.trim().to_string())
+        .filter(|code| !code.is_empty())
+        .collect();
+    categories.sort();
+    categories.dedup();
+    if !categories.is_empty() {
+        let known = match state
+            .admin_moderation_store
+            .list_moderation_categories()
+            .await
+        {
+            Ok(known) => known,
+            Err(_) => {
+                return internal_error("Failed to load moderation categories").into_response()
+            },
+        };
+        let known: std::collections::HashSet<&str> = known
+            .iter()
+            .map(|category| category.code.as_str())
+            .collect();
+        if let Some(unknown) = categories
+            .iter()
+            .find(|code| !known.contains(code.as_str()))
+        {
+            return bad_request(&format!("unknown category code `{unknown}`")).into_response();
+        }
+    }
     let note = request
         .note
         .as_deref()
@@ -3219,6 +3382,7 @@ pub(crate) async fn add_admin_moderation_keywords(
         .into_iter()
         .map(|keyword| core_store::NewModerationKeyword {
             keyword,
+            categories: categories.clone(),
             note: note.clone(),
             source: source.to_string(),
             created_at_ms,
diff --git a/crates/llm-access/src/lib.rs b/crates/llm-access/src/lib.rs
index ab2e53ef..131f5e9b 100644
--- a/crates/llm-access/src/lib.rs
+++ b/crates/llm-access/src/lib.rs
@@ -446,6 +446,15 @@ pub fn router_with_simulator(
             "/admin/kiro-gateway/anthropic-upstreams/:name/test",
             post(admin::test_admin_anthropic_upstream_model),
         )
+        .route(
+            "/admin/llm-gateway/moderation/categories",
+            get(admin::list_admin_moderation_categories)
+                .post(admin::add_admin_moderation_categories),
+        )
+        .route(
+            "/admin/llm-gateway/moderation/categories/:code",
+            delete(admin::delete_admin_moderation_category),
+        )
         .route(
             "/admin/llm-gateway/moderation/keywords",
             get(admin::list_admin_moderation_keywords).post(admin::add_admin_moderation_keywords),
diff --git a/crates/llm-access/src/moderation.rs b/crates/llm-access/src/moderation.rs
index d907afb2..6d014835 100644
--- a/crates/llm-access/src/moderation.rs
+++ b/crates/llm-access/src/moderation.rs
@@ -170,7 +170,7 @@ impl ModerationGate {
             snapshot
                 .keywords
                 .iter()
-                .map(|keyword| keyword.keyword.as_str()),
+                .map(|keyword| (keyword.keyword.as_str(), keyword.categories.clone())),
         )?
         .map(Arc::new);
         let keyword_count = matcher
@@ -386,6 +386,7 @@ pub(crate) fn enforce_moderation(
                 key_name: request.key.key_name.clone(),
                 session_id: request.session_id.unwrap_or_default().to_string(),
                 matched_keyword: hit.keyword,
+                matched_categories: hit.categories,
                 matched_context: hit.context,
                 endpoint: request.endpoint.to_string(),
                 model: request.model.to_string(),

From d938b68e427d4f92b4a66153fa5d7b699dd3c0c4 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 19:26:18 +0800
Subject: [PATCH 08/11] fix(llm-access): make moderation unban hit-scoped

---
 crates/frontend/src/api.rs                    |   8 +-
 crates/frontend/src/pages/admin_moderation.rs |   3 +-
 crates/llm-access-core/src/moderation.rs      |  89 ++-
 crates/llm-access-core/src/store/mod.rs       |   4 +-
 .../llm-access-core/src/store/moderation.rs   |  47 +-
 crates/llm-access-core/src/store/traits.rs    |   4 +-
 .../postgres/0036_keyword_moderation.sql      |  18 +-
 crates/llm-access-store/src/postgres.rs       |  38 +-
 .../src/postgres/moderation.rs                | 113 ++--
 crates/llm-access/src/admin.rs                |   6 +-
 crates/llm-access/src/moderation.rs           | 505 ++++++++++++++++--
 11 files changed, 723 insertions(+), 112 deletions(-)

diff --git a/crates/frontend/src/api.rs b/crates/frontend/src/api.rs
index 0d121b7f..f0a99aba 100644
--- a/crates/frontend/src/api.rs
+++ b/crates/frontend/src/api.rs
@@ -11014,7 +11014,8 @@ pub struct ModerationGateStatsView {
     pub loaded_at_ms: Option<i64>,
     pub keyword_count: usize,
     pub banned_session_count: usize,
-    pub allowed_session_count: usize,
+    pub suppressed_hit_count: usize,
+    pub resume_cursor_count: usize,
     pub blocked_requests_total: u64,
     pub persist_failures_total: u64,
 }
@@ -11049,6 +11050,7 @@ pub struct AddAdminModerationKeywordsResponse {
 #[serde(default)]
 pub struct ModerationBannedSessionView {
     pub id: i64,
+    pub hit_key: String,
     pub session_key: String,
     pub provider: String,
     pub key_id: String,
@@ -11057,6 +11059,10 @@ pub struct ModerationBannedSessionView {
     pub matched_keyword: String,
     pub matched_categories: Vec<String>,
     pub matched_context: String,
+    pub match_start: i64,
+    pub match_end: i64,
+    pub match_prefix_sha256: String,
+    pub keyword_set_hash: String,
     pub endpoint: String,
     pub model: String,
     pub client_ip: String,
diff --git a/crates/frontend/src/pages/admin_moderation.rs b/crates/frontend/src/pages/admin_moderation.rs
index 08b976df..bde74525 100644
--- a/crates/frontend/src/pages/admin_moderation.rs
+++ b/crates/frontend/src/pages/admin_moderation.rs
@@ -307,7 +307,7 @@ pub fn admin_moderation_page() -> Html {
                 <div class={classes!("grid", "gap-3", "sm:grid-cols-2", "lg:grid-cols-4")}>
                     { stat_card("Keywords", stats.keyword_count.to_string(), stats.loaded) }
                     { stat_card("Banned sessions", stats.banned_session_count.to_string(), stats.loaded) }
-                    { stat_card("Allowlisted", stats.allowed_session_count.to_string(), stats.loaded) }
+                    { stat_card("Suppressed hits", stats.suppressed_hit_count.to_string(), stats.loaded) }
                     { stat_card("Blocked requests", stats.blocked_requests_total.to_string(), stats.loaded) }
                 </div>
 
@@ -919,6 +919,7 @@ fn detail_panel(
                 { detail_field("Client IP", &session.client_ip) }
                 { detail_field("Session id", &session.session_id) }
                 { detail_field("Matched keyword", &session.matched_keyword) }
+                { detail_field("Match range", &format!("{}..{}", session.match_start, session.match_end)) }
             </div>
             <div class={classes!("flex", "items-center", "gap-2")}>
                 <span class={classes!("font-mono", "text-xs", "uppercase", "tracking-wider", "text-[var(--muted)]")}>{ "Categories:" }</span>
diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
index 8822206d..cf822974 100644
--- a/crates/llm-access-core/src/moderation.rs
+++ b/crates/llm-access-core/src/moderation.rs
@@ -81,6 +81,10 @@ pub struct ModerationMatch {
     /// Risk-category codes attached to the keyword that fired (a keyword may
     /// belong to several categories, e.g. `["fraud", "cyber"]`).
     pub categories: Vec<String>,
+    /// Byte offset where the hit starts in the normalized request text.
+    pub match_start: usize,
+    /// Byte offset just after the hit in the normalized request text.
+    pub match_end: usize,
     /// Context snippet around the hit taken from the normalized text.
     pub context: String,
 }
@@ -144,22 +148,78 @@ impl ModerationMatcher {
     /// [`normalize_moderation_text`] output (canonical single-space-joined
     /// terms).
     pub fn find(&self, normalized_text: &str) -> Option<ModerationMatch> {
+        self.find_inner(normalized_text, 0, None)
+    }
+
+    /// Scan tokenized text from `start_at` and return the first phrase hit
+    /// whose start offset is at or after `start_at`.
+    pub fn find_from(&self, normalized_text: &str, start_at: usize) -> Option<ModerationMatch> {
+        self.find_inner(
+            normalized_text,
+            start_at.min(normalized_text.len()),
+            Some((start_at, false)),
+        )
+    }
+
+    /// Scan tokenized text from `start_after` and return the first phrase hit
+    /// whose start offset is greater than `start_after`.
+    pub fn find_after(&self, normalized_text: &str, start_after: usize) -> Option<ModerationMatch> {
+        self.find_inner(
+            normalized_text,
+            start_after.min(normalized_text.len()),
+            Some((start_after, true)),
+        )
+    }
+
+    fn find_inner(
+        &self,
+        normalized_text: &str,
+        scan_start: usize,
+        start_limit: Option<(usize, bool)>,
+    ) -> Option<ModerationMatch> {
+        let scan_start = next_char_boundary(normalized_text, scan_start);
         let haystack = normalized_text.as_bytes();
-        for candidate in self.automaton.find_overlapping_iter(normalized_text) {
-            if !match_on_term_boundaries(haystack, candidate.start(), candidate.end()) {
+        for candidate in self
+            .automaton
+            .find_overlapping_iter(&normalized_text[scan_start..])
+        {
+            let start = scan_start + candidate.start();
+            let end = scan_start + candidate.end();
+            if start_limit.is_some_and(
+                |(offset, exclusive)| {
+                    if exclusive {
+                        start <= offset
+                    } else {
+                        start < offset
+                    }
+                },
+            ) {
+                continue;
+            }
+            if !match_on_term_boundaries(haystack, start, end) {
                 continue;
             }
             let index = candidate.pattern().as_usize();
             return Some(ModerationMatch {
                 keyword: self.patterns[index].clone(),
                 categories: self.categories[index].clone(),
-                context: match_context_snippet(normalized_text, candidate.start(), candidate.end()),
+                match_start: start,
+                match_end: end,
+                context: match_context_snippet(normalized_text, start, end),
             });
         }
         None
     }
 }
 
+fn next_char_boundary(text: &str, offset: usize) -> usize {
+    let mut offset = offset.min(text.len());
+    while offset < text.len() && !text.is_char_boundary(offset) {
+        offset += 1;
+    }
+    offset
+}
+
 /// In the canonical form every term is separated by exactly one ASCII space
 /// (byte `0x20`), which never appears inside a multi-byte UTF-8 sequence, so a
 /// hit aligns to term boundaries iff it is delimited by a space or the string
@@ -394,9 +454,32 @@ mod tests {
         let text = normalize_moderation_text("please join the free\npalestine   movement now");
         let hit = matcher.find(&text).expect("phrase should match");
         assert_eq!(hit.keyword, "free palestine movement");
+        assert_eq!(hit.match_start, text.find("free").expect("hit offset"));
+        assert_eq!(hit.match_end, text.find(" now").expect("hit end marker"));
         assert!(hit.context.contains("free palestine movement"));
     }
 
+    #[test]
+    fn find_from_includes_resume_position_and_find_after_skips_it() {
+        let matcher = matcher(&["build a bomb", "carding tutorial"]);
+        let text = normalize_moderation_text(
+            "first false positive: build a bomb. Later request asks for carding tutorial.",
+        );
+        let first = matcher.find(&text).expect("first phrase should match");
+        assert_eq!(first.keyword, "build a bomb");
+
+        let resumed = matcher
+            .find_from(&text, first.match_start)
+            .expect("resume scan should inspect the reviewed position");
+        assert_eq!(resumed.keyword, "build a bomb");
+
+        let second = matcher
+            .find_after(&text, first.match_start)
+            .expect("resume scan should continue past reviewed hit");
+        assert_eq!(second.keyword, "carding tutorial");
+        assert!(second.match_start > first.match_start);
+    }
+
     #[test]
     fn phrase_match_tolerates_punctuation_in_text() {
         let matcher = matcher(&["build a bomb"]);
diff --git a/crates/llm-access-core/src/store/mod.rs b/crates/llm-access-core/src/store/mod.rs
index 118e34d2..8c8ecded 100644
--- a/crates/llm-access-core/src/store/mod.rs
+++ b/crates/llm-access-core/src/store/mod.rs
@@ -80,8 +80,8 @@ pub use kiro_model_routing::{
 pub use moderation::{
     ModerationBannedSession, ModerationBannedSessionDetail, ModerationBannedSessionsPage,
     ModerationCategory, ModerationKeyword, ModerationKeywordImportOutcome,
-    ModerationRuntimeSnapshot, NewModerationBannedSession, NewModerationCategory,
-    NewModerationKeyword, MODERATION_CATEGORY_SEVERITY_CRITICAL,
+    ModerationRuntimeSnapshot, ModerationSuppressedHit, NewModerationBannedSession,
+    NewModerationCategory, NewModerationKeyword, MODERATION_CATEGORY_SEVERITY_CRITICAL,
     MODERATION_CATEGORY_SEVERITY_MEDIUM, MODERATION_KEYWORD_SOURCE_JSON,
     MODERATION_KEYWORD_SOURCE_TXT, MODERATION_SESSION_STATUS_BANNED,
     MODERATION_SESSION_STATUS_UNBANNED,
diff --git a/crates/llm-access-core/src/store/moderation.rs b/crates/llm-access-core/src/store/moderation.rs
index c1b7e152..9367b188 100644
--- a/crates/llm-access-core/src/store/moderation.rs
+++ b/crates/llm-access-core/src/store/moderation.rs
@@ -4,8 +4,8 @@ use serde::{Deserialize, Serialize};
 
 /// Ban record status: the session is actively blocked.
 pub const MODERATION_SESSION_STATUS_BANNED: &str = "banned";
-/// Ban record status: a reviewer cleared the session; it is allowlisted and
-/// skipped by keyword scans.
+/// Ban record status: a reviewer cleared this hit; later scans skip this hit
+/// position, not the whole session.
 pub const MODERATION_SESSION_STATUS_UNBANNED: &str = "unbanned";
 
 /// Keyword import source label for plain-text payloads.
@@ -99,6 +99,8 @@ pub struct ModerationKeywordImportOutcome {
 pub struct ModerationBannedSession {
     /// Stable row id.
     pub id: i64,
+    /// Stable key for this exact hit inside this session.
+    pub hit_key: String,
     /// Runtime ban key: `provider:key_id:session_id`.
     pub session_key: String,
     /// Provider family that produced the ban (`kiro` or `codex`).
@@ -116,6 +118,15 @@ pub struct ModerationBannedSession {
     pub matched_categories: Vec<String>,
     /// Context snippet around the hit from the normalized request text.
     pub matched_context: String,
+    /// Byte offset where the hit starts in normalized request text.
+    pub match_start: i64,
+    /// Byte offset just after the hit in normalized request text.
+    pub match_end: i64,
+    /// SHA-256 of normalized text before `match_start`, used to validate
+    /// resumable scans.
+    pub match_prefix_sha256: String,
+    /// Hash of the keyword set active when this hit was recorded.
+    pub keyword_set_hash: String,
     /// Gateway endpoint that received the blocked request.
     pub endpoint: String,
     /// Requested model, if known.
@@ -148,6 +159,8 @@ pub struct ModerationBannedSessionDetail {
 /// Insert payload for one new banned session.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct NewModerationBannedSession {
+    /// Stable key for this exact hit inside this session.
+    pub hit_key: String,
     /// Runtime ban key: `provider:key_id:session_id`.
     pub session_key: String,
     /// Provider family (`kiro` or `codex`).
@@ -164,6 +177,14 @@ pub struct NewModerationBannedSession {
     pub matched_categories: Vec<String>,
     /// Context snippet around the hit.
     pub matched_context: String,
+    /// Byte offset where the hit starts in normalized request text.
+    pub match_start: i64,
+    /// Byte offset just after the hit in normalized request text.
+    pub match_end: i64,
+    /// SHA-256 of normalized text before `match_start`.
+    pub match_prefix_sha256: String,
+    /// Hash of the keyword set active when this hit was recorded.
+    pub keyword_set_hash: String,
     /// Gateway endpoint.
     pub endpoint: String,
     /// Requested model, if known.
@@ -178,6 +199,24 @@ pub struct NewModerationBannedSession {
     pub banned_at_ms: i64,
 }
 
+/// One reviewed false-positive hit used by the runtime gate to skip repeat
+/// matches and resume near the last reviewed position.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ModerationSuppressedHit {
+    /// Runtime ban key: `provider:key_id:session_id`.
+    pub session_key: String,
+    /// Stable key for this exact hit inside this session.
+    pub hit_key: String,
+    /// Byte offset where the reviewed hit starts in normalized request text.
+    pub match_start: i64,
+    /// Byte offset just after the reviewed hit in normalized request text.
+    pub match_end: i64,
+    /// SHA-256 of normalized text before `match_start`.
+    pub match_prefix_sha256: String,
+    /// Hash of the keyword set active when this hit was recorded.
+    pub keyword_set_hash: String,
+}
+
 /// One page of banned sessions.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct ModerationBannedSessionsPage {
@@ -200,6 +239,6 @@ pub struct ModerationRuntimeSnapshot {
     pub keywords: Vec<ModerationKeyword>,
     /// Session keys with `banned` status.
     pub banned_session_keys: Vec<String>,
-    /// Session keys with `unbanned` status (reviewer allowlist).
-    pub allowed_session_keys: Vec<String>,
+    /// Reviewed false-positive hits with `unbanned` status.
+    pub suppressed_hits: Vec<ModerationSuppressedHit>,
 }
diff --git a/crates/llm-access-core/src/store/traits.rs b/crates/llm-access-core/src/store/traits.rs
index 5ec7414c..8b06c188 100644
--- a/crates/llm-access-core/src/store/traits.rs
+++ b/crates/llm-access-core/src/store/traits.rs
@@ -290,8 +290,8 @@ pub trait AdminAnthropicUpstreamStore: Send + Sync {
 #[async_trait]
 pub trait AdminModerationStore: Send + Sync {
     /// Load the compact runtime snapshot consumed by the in-memory gate:
-    /// all keywords (with their categories) plus banned/allowlisted session
-    /// keys.
+    /// all keywords (with their categories), active banned session keys, and
+    /// reviewed false-positive hits.
     async fn load_moderation_runtime_snapshot(&self) -> anyhow::Result<ModerationRuntimeSnapshot>;
 
     /// List all configured risk categories.
diff --git a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
index 375f2e30..c88fdfff 100644
--- a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
+++ b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
@@ -7,7 +7,7 @@
 --
 --   llm_moderation_keywords         -- one row per banned phrase (canonical,
 --                                      already tokenized; UNIQUE for dedup)
---   llm_moderation_banned_sessions  -- one row per banned session, with the
+--   llm_moderation_banned_sessions  -- one row per banned hit, with the
 --                                      captured request body + headers (TEXT,
 --                                      verbatim) for reviewer inspection
 
@@ -21,13 +21,18 @@ CREATE TABLE IF NOT EXISTS llm_moderation_keywords (
 
 CREATE TABLE IF NOT EXISTS llm_moderation_banned_sessions (
     id BIGSERIAL PRIMARY KEY,
-    session_key TEXT NOT NULL UNIQUE CHECK (length(session_key) > 0),
+    hit_key TEXT NOT NULL UNIQUE CHECK (length(hit_key) > 0),
+    session_key TEXT NOT NULL CHECK (length(session_key) > 0),
     provider TEXT NOT NULL,
     key_id TEXT NOT NULL,
     key_name TEXT NOT NULL DEFAULT '',
     session_id TEXT NOT NULL DEFAULT '',
     matched_keyword TEXT NOT NULL,
     matched_context TEXT NOT NULL DEFAULT '',
+    match_start BIGINT NOT NULL CHECK (match_start >= 0),
+    match_end BIGINT NOT NULL CHECK (match_end >= match_start),
+    match_prefix_sha256 TEXT NOT NULL DEFAULT '',
+    keyword_set_hash TEXT NOT NULL DEFAULT '',
     endpoint TEXT NOT NULL DEFAULT '',
     model TEXT NOT NULL DEFAULT '',
     client_ip TEXT NOT NULL DEFAULT '',
@@ -43,7 +48,14 @@ CREATE TABLE IF NOT EXISTS llm_moderation_banned_sessions (
 );
 
 CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_status_banned_at
-    ON llm_moderation_banned_sessions(status, banned_at_ms DESC);
+    ON llm_moderation_banned_sessions(status, banned_at_ms DESC, id DESC);
+
+CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_banned_at
+    ON llm_moderation_banned_sessions(banned_at_ms DESC, id DESC);
 
 CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_key_id
     ON llm_moderation_banned_sessions(key_id, banned_at_ms DESC);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_active_session
+    ON llm_moderation_banned_sessions(session_key)
+    WHERE status = 'banned';
diff --git a/crates/llm-access-store/src/postgres.rs b/crates/llm-access-store/src/postgres.rs
index 029784e9..08320f6f 100644
--- a/crates/llm-access-store/src/postgres.rs
+++ b/crates/llm-access-store/src/postgres.rs
@@ -2134,8 +2134,9 @@ mod tests {
             1
         );
 
-        // Banned sessions: JSONB body + headers persisted, session_key unique.
+        // Banned hits: JSONB body + headers persisted, hit_key unique.
         let record = NewModerationBannedSession {
+            hit_key: "hit-1".to_string(),
             session_key: "kiro:key-1:sess-1".to_string(),
             provider: "kiro".to_string(),
             key_id: "key-1".to_string(),
@@ -2144,6 +2145,10 @@ mod tests {
             matched_keyword: "build a bomb".to_string(),
             matched_categories: vec!["weapons".to_string()],
             matched_context: "…how to build a bomb now…".to_string(),
+            match_start: 7,
+            match_end: 19,
+            match_prefix_sha256: "prefix-1".to_string(),
+            keyword_set_hash: "keywords-v1".to_string(),
             endpoint: "/v1/messages".to_string(),
             model: "claude-sonnet-4".to_string(),
             client_ip: "127.0.0.1".to_string(),
@@ -2158,13 +2163,14 @@ mod tests {
             .record_moderation_banned_session(record.clone())
             .await
             .expect("record banned session"));
-        // Duplicate session_key: ON CONFLICT DO NOTHING -> not inserted again.
+        // Duplicate hit_key: ON CONFLICT DO NOTHING -> not inserted again.
         assert!(!repo
             .record_moderation_banned_session(record.clone())
             .await
             .expect("record duplicate banned session"));
 
         let second = NewModerationBannedSession {
+            hit_key: "hit-2".to_string(),
             session_key: "codex:key-1:sess-2".to_string(),
             provider: "codex".to_string(),
             session_id: "sess-2".to_string(),
@@ -2240,14 +2246,38 @@ mod tests {
             .expect("list unbanned sessions");
         assert_eq!(unbanned.total, 1);
 
+        let followup_same_session = NewModerationBannedSession {
+            hit_key: "hit-3".to_string(),
+            matched_keyword: "carding tutorial".to_string(),
+            matched_categories: vec!["cyber".to_string()],
+            matched_context: "…carding tutorial…".to_string(),
+            match_start: 40,
+            match_end: 56,
+            match_prefix_sha256: "prefix-2".to_string(),
+            keyword_set_hash: "keywords-v1".to_string(),
+            banned_at_ms: now + 2,
+            ..record.clone()
+        };
+        assert!(repo
+            .record_moderation_banned_session(followup_same_session)
+            .await
+            .expect("record follow-up hit for same session"));
+
         // Runtime snapshot mirrors the in-memory gate contract exactly.
         let snapshot = repo
             .load_moderation_runtime_snapshot()
             .await
             .expect("load moderation runtime snapshot");
         assert_eq!(snapshot.keywords.len(), 1);
-        assert_eq!(snapshot.banned_session_keys, vec!["codex:key-1:sess-2".to_string()]);
-        assert_eq!(snapshot.allowed_session_keys, vec!["kiro:key-1:sess-1".to_string()]);
+        let mut banned_session_keys = snapshot.banned_session_keys;
+        banned_session_keys.sort();
+        assert_eq!(banned_session_keys, vec![
+            "codex:key-1:sess-2".to_string(),
+            "kiro:key-1:sess-1".to_string(),
+        ]);
+        assert_eq!(snapshot.suppressed_hits.len(), 1);
+        assert_eq!(snapshot.suppressed_hits[0].hit_key, "hit-1");
+        assert_eq!(snapshot.suppressed_hits[0].session_key, "kiro:key-1:sess-1");
     }
 
     #[tokio::test]
diff --git a/crates/llm-access-store/src/postgres/moderation.rs b/crates/llm-access-store/src/postgres/moderation.rs
index a881885e..07f6c14a 100644
--- a/crates/llm-access-store/src/postgres/moderation.rs
+++ b/crates/llm-access-store/src/postgres/moderation.rs
@@ -6,9 +6,9 @@ use async_trait::async_trait;
 use llm_access_core::store::{
     AdminModerationStore, AdminPageRequest, ModerationBannedSession, ModerationBannedSessionDetail,
     ModerationBannedSessionsPage, ModerationCategory, ModerationKeyword,
-    ModerationKeywordImportOutcome, ModerationRuntimeSnapshot, NewModerationBannedSession,
-    NewModerationCategory, NewModerationKeyword, MODERATION_SESSION_STATUS_BANNED,
-    MODERATION_SESSION_STATUS_UNBANNED,
+    ModerationKeywordImportOutcome, ModerationRuntimeSnapshot, ModerationSuppressedHit,
+    NewModerationBannedSession, NewModerationCategory, NewModerationKeyword,
+    MODERATION_SESSION_STATUS_BANNED, MODERATION_SESSION_STATUS_UNBANNED,
 };
 
 use super::{now_ms, PgRow, PostgresControlRepository};
@@ -19,9 +19,10 @@ const MODERATION_KEYWORD_COLUMNS: &str =
     "id, keyword, note, source, created_at_ms, category_codes::text";
 
 const MODERATION_BANNED_SESSION_COLUMNS: &str =
-    "id, session_key, provider, key_id, key_name, session_id, matched_keyword, matched_context, \
-     endpoint, model, client_ip, status, review_note, banned_at_ms, reviewed_at_ms, \
-     updated_at_ms, matched_categories::text";
+    "id, hit_key, session_key, provider, key_id, key_name, session_id, matched_keyword, \
+     matched_context, match_start, match_end, match_prefix_sha256, keyword_set_hash, endpoint, \
+     model, client_ip, status, review_note, banned_at_ms, reviewed_at_ms, updated_at_ms, \
+     matched_categories::text";
 
 /// Decode a JSONB text-array column (e.g. `["csam","cyber"]`) into codes. A
 /// malformed value degrades to an empty list rather than failing the row.
@@ -57,22 +58,27 @@ fn moderation_keyword_from_row(row: &PgRow) -> ModerationKeyword {
 fn moderation_banned_session_from_row(row: &PgRow) -> ModerationBannedSession {
     ModerationBannedSession {
         id: row.get(0),
-        session_key: row.get(1),
-        provider: row.get(2),
-        key_id: row.get(3),
-        key_name: row.get(4),
-        session_id: row.get(5),
-        matched_keyword: row.get(6),
-        matched_context: row.get(7),
-        endpoint: row.get(8),
-        model: row.get(9),
-        client_ip: row.get(10),
-        status: row.get(11),
-        review_note: row.get(12),
-        banned_at_ms: row.get(13),
-        reviewed_at_ms: row.get(14),
-        updated_at_ms: row.get(15),
-        matched_categories: category_codes_from_json_text(row.get(16)),
+        hit_key: row.get(1),
+        session_key: row.get(2),
+        provider: row.get(3),
+        key_id: row.get(4),
+        key_name: row.get(5),
+        session_id: row.get(6),
+        matched_keyword: row.get(7),
+        matched_context: row.get(8),
+        match_start: row.get(9),
+        match_end: row.get(10),
+        match_prefix_sha256: row.get(11),
+        keyword_set_hash: row.get(12),
+        endpoint: row.get(13),
+        model: row.get(14),
+        client_ip: row.get(15),
+        status: row.get(16),
+        review_note: row.get(17),
+        banned_at_ms: row.get(18),
+        reviewed_at_ms: row.get(19),
+        updated_at_ms: row.get(20),
+        matched_categories: category_codes_from_json_text(row.get(21)),
     }
 }
 
@@ -90,26 +96,43 @@ impl AdminModerationStore for PostgresControlRepository {
     async fn load_moderation_runtime_snapshot(&self) -> anyhow::Result<ModerationRuntimeSnapshot> {
         self.ensure_connection_alive()?;
         let keywords = self.list_moderation_keywords().await?;
-        let rows = self
+        let banned_rows = self
             .client
-            .query("SELECT session_key, status FROM llm_moderation_banned_sessions", &[])
+            .query(
+                "SELECT DISTINCT session_key
+                 FROM llm_moderation_banned_sessions
+                 WHERE status = 'banned'",
+                &[],
+            )
             .await
             .context("load postgres moderation banned session keys")?;
-        let mut banned_session_keys = Vec::new();
-        let mut allowed_session_keys = Vec::new();
-        for row in rows {
-            let session_key: String = row.get(0);
-            let status: String = row.get(1);
-            if status == MODERATION_SESSION_STATUS_UNBANNED {
-                allowed_session_keys.push(session_key);
-            } else {
-                banned_session_keys.push(session_key);
-            }
-        }
+        let banned_session_keys = banned_rows.iter().map(|row| row.get(0)).collect();
+        let suppressed_rows = self
+            .client
+            .query(
+                "SELECT session_key, hit_key, match_start, match_end, match_prefix_sha256,
+                        keyword_set_hash
+                 FROM llm_moderation_banned_sessions
+                 WHERE status = 'unbanned'",
+                &[],
+            )
+            .await
+            .context("load postgres moderation suppressed hit keys")?;
+        let suppressed_hits = suppressed_rows
+            .iter()
+            .map(|row| ModerationSuppressedHit {
+                session_key: row.get(0),
+                hit_key: row.get(1),
+                match_start: row.get(2),
+                match_end: row.get(3),
+                match_prefix_sha256: row.get(4),
+                keyword_set_hash: row.get(5),
+            })
+            .collect();
         Ok(ModerationRuntimeSnapshot {
             keywords,
             banned_session_keys,
-            allowed_session_keys,
+            suppressed_hits,
         })
     }
 
@@ -287,6 +310,7 @@ impl AdminModerationStore for PostgresControlRepository {
             .client
             .execute(
                 "INSERT INTO llm_moderation_banned_sessions (
+                    hit_key,
                     session_key,
                     provider,
                     key_id,
@@ -294,6 +318,10 @@ impl AdminModerationStore for PostgresControlRepository {
                     session_id,
                     matched_keyword,
                     matched_context,
+                    match_start,
+                    match_end,
+                    match_prefix_sha256,
+                    keyword_set_hash,
                     endpoint,
                     model,
                     client_ip,
@@ -305,9 +333,10 @@ impl AdminModerationStore for PostgresControlRepository {
                     updated_at_ms
                  )
                  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
-                         $13::jsonb, 'banned', $14, $14)
-                 ON CONFLICT (session_key) DO NOTHING",
+                         $13, $14, $15, $16, $17, $18::jsonb, 'banned', $19, $19)
+                 ON CONFLICT DO NOTHING",
                 &[
+                    &record.hit_key,
                     &record.session_key,
                     &record.provider,
                     &record.key_id,
@@ -315,6 +344,10 @@ impl AdminModerationStore for PostgresControlRepository {
                     &record.session_id,
                     &record.matched_keyword,
                     &record.matched_context,
+                    &record.match_start,
+                    &record.match_end,
+                    &record.match_prefix_sha256,
+                    &record.keyword_set_hash,
                     &record.endpoint,
                     &record.model,
                     &record.client_ip,
@@ -421,8 +454,8 @@ impl AdminModerationStore for PostgresControlRepository {
         };
         Ok(Some(ModerationBannedSessionDetail {
             session: moderation_banned_session_from_row(&row),
-            request_headers_json: row.get(17),
-            request_body_json: row.get(18),
+            request_headers_json: row.get(22),
+            request_body_json: row.get(23),
         }))
     }
 
diff --git a/crates/llm-access/src/admin.rs b/crates/llm-access/src/admin.rs
index 93d03798..6162e014 100644
--- a/crates/llm-access/src/admin.rs
+++ b/crates/llm-access/src/admin.rs
@@ -3260,7 +3260,7 @@ pub(crate) struct AdminModerationBannedSessionsQuery {
 
 #[derive(Debug, Deserialize)]
 pub(crate) struct ReviewAdminModerationBannedSessionRequest {
-    /// `true` keeps the ban, `false` unbans (allowlists) the session.
+    /// `true` keeps this hit banned, `false` suppresses this reviewed hit.
     banned: bool,
     #[serde(default)]
     review_note: Option<String>,
@@ -3510,9 +3510,7 @@ pub(crate) async fn review_admin_moderation_banned_session(
         .await
     {
         Ok(Some(session)) => {
-            state
-                .moderation_gate
-                .apply_review(&session.session_key, request.banned);
+            reload_moderation_gate(&state).await;
             Json(session).into_response()
         },
         Ok(None) => not_found("Banned session not found").into_response(),
diff --git a/crates/llm-access/src/moderation.rs b/crates/llm-access/src/moderation.rs
index 6d014835..ebdc7b31 100644
--- a/crates/llm-access/src/moderation.rs
+++ b/crates/llm-access/src/moderation.rs
@@ -9,12 +9,13 @@
 //!
 //! The hot path reads only process memory and never queries Postgres. Postgres
 //! is the durable control plane: read on startup / periodic refresh / admin
-//! change, and written exactly once per *newly* banned session.
+//! change, and written exactly once per *newly* banned hit.
 //!
 //! ```text
 //!   ┌──────────────────── in process memory (RwLock<ModerationGateState>) ────────────────┐
 //!   │  matcher : Aho-Corasick automaton compiled from every keyword                        │
-//!   │  banned  : HashSet<session_key>     allowed : HashSet<session_key>  (reviewer clears) │
+//!   │  banned  : HashSet<session_key>     suppressed_hit_keys : HashSet<hit_key>            │
+//!   │  resume_cursors : HashMap<session_key, Vec<reviewed hit position>>                    │
 //!   └─────────────────────────────────────────────────────────────────────────────────────┘
 //!        ▲ reload(): full snapshot  — startup, every N minutes, and after any admin change
 //!        │ ban_session(): ONE spawned INSERT per new ban (body + headers), off the hot path
@@ -44,11 +45,11 @@
 //!     ▼
 //!   precheck(session_key)
 //!     ├── Blocked  (session already banned) ─────────▶ BLOCK   (no scan, no DB write)
-//!     ├── Skip     (allowlisted, or no keywords) ────▶ ALLOW
-//!     └── Scan(automaton)
+//!     ├── Skip     (no keywords) ───────────────────▶ ALLOW
+//!     └── Scan(automaton + suppressed hit keys + cursors)
 //!            │
-//!            ▼  extract user-visible text ─▶ tokenize ─▶ run automaton (see llm_access_core)
-//!          hit? ──no──▶ ALLOW
+//!            ▼  extract user-visible text ─▶ tokenize ─▶ resume/scan (see llm_access_core)
+//!          unsuppressed hit? ──no──▶ ALLOW
 //!            │ yes
 //!            ▼  ban_session(): insert into `banned` (memory) + spawn one Postgres capture
 //!          BLOCK  ──▶ caller returns the provider-specific rejection (Kiro/Codex error shape)
@@ -57,12 +58,13 @@
 //! A `BLOCK` decision stops this and every subsequent request for the session:
 //! the key is now in the in-memory `banned` set, so the next request short-
 //! circuits at `precheck` without touching the body or Postgres. A reviewer
-//! moves the key from `banned` to `allowed` via the admin API, which both
-//! updates the store and calls [`ModerationGate::apply_review`] so the running
-//! process reflects the decision immediately.
+//! reviews the hit as `unbanned` via the admin API, the next snapshot treats
+//! that hit position as suppressed; later content in the same session can still
+//! be scanned and banned.
 
 use std::{
-    collections::HashSet,
+    collections::{HashMap, HashSet},
+    fmt::Write as _,
     sync::{
         atomic::{AtomicU64, Ordering},
         Arc, RwLock,
@@ -72,10 +74,12 @@ use std::{
 
 use axum::http::HeaderMap;
 use llm_access_core::{
-    moderation::{extract_moderation_text, normalize_moderation_text, ModerationMatcher},
+    moderation::{
+        extract_moderation_text, normalize_moderation_text, ModerationMatch, ModerationMatcher,
+    },
     store::{
-        AdminModerationStore, AuthenticatedKey, EmptyAdminModerationStore,
-        NewModerationBannedSession,
+        AdminModerationStore, AuthenticatedKey, EmptyAdminModerationStore, ModerationKeyword,
+        ModerationSuppressedHit, NewModerationBannedSession,
     },
 };
 use llm_access_kiro::anthropic::types::MessagesRequest;
@@ -104,11 +108,24 @@ const REDACTED_HEADER_NAMES: [&str; 5] =
 pub(crate) enum ModerationPrecheck {
     /// Session key is already banned: reject without scanning or writing.
     Blocked,
-    /// Session key was cleared by a reviewer, or the gate has no keywords /
-    /// no loaded snapshot yet: skip scanning entirely.
+    /// The gate has no keywords / no loaded snapshot yet: skip scanning.
     Skip,
     /// Scan the request text with the compiled automaton.
-    Scan(Arc<ModerationMatcher>),
+    Scan(ModerationScanPlan),
+}
+
+pub(crate) struct ModerationScanPlan {
+    matcher: Arc<ModerationMatcher>,
+    keyword_set_hash: String,
+    suppressed_hit_keys: Arc<HashSet<String>>,
+    resume_cursors: Vec<ModerationResumeCursor>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct ModerationResumeCursor {
+    match_start: usize,
+    match_prefix_sha256: String,
+    keyword_set_hash: String,
 }
 
 #[derive(Default)]
@@ -116,7 +133,9 @@ struct ModerationGateState {
     matcher: Option<Arc<ModerationMatcher>>,
     keyword_count: usize,
     banned: HashSet<String>,
-    allowed: HashSet<String>,
+    suppressed_hit_keys: Arc<HashSet<String>>,
+    resume_cursors: HashMap<String, Vec<ModerationResumeCursor>>,
+    keyword_set_hash: String,
     loaded: bool,
     loaded_at_ms: Option<i64>,
 }
@@ -128,7 +147,8 @@ pub(crate) struct ModerationGateStats {
     pub loaded_at_ms: Option<i64>,
     pub keyword_count: usize,
     pub banned_session_count: usize,
-    pub allowed_session_count: usize,
+    pub suppressed_hit_count: usize,
+    pub resume_cursor_count: usize,
     pub blocked_requests_total: u64,
     pub persist_failures_total: u64,
 }
@@ -166,6 +186,7 @@ impl ModerationGate {
     /// Reload the keyword automaton and session sets from the store.
     pub async fn reload(&self) -> anyhow::Result<()> {
         let snapshot = self.store.load_moderation_runtime_snapshot().await?;
+        let keyword_set_hash = moderation_keyword_set_hash(&snapshot.keywords);
         let matcher = ModerationMatcher::build(
             snapshot
                 .keywords
@@ -177,11 +198,24 @@ impl ModerationGate {
             .as_ref()
             .map(|matcher| matcher.pattern_count())
             .unwrap_or(0);
+        let mut suppressed_hit_keys = HashSet::with_capacity(snapshot.suppressed_hits.len());
+        let mut resume_cursors: HashMap<String, Vec<ModerationResumeCursor>> = HashMap::new();
+        for hit in snapshot.suppressed_hits {
+            suppressed_hit_keys.insert(hit.hit_key.clone());
+            if let Some(cursor) = moderation_resume_cursor_from_hit(&hit) {
+                resume_cursors
+                    .entry(hit.session_key)
+                    .or_default()
+                    .push(cursor);
+            }
+        }
         let mut state = self.state.write().expect("moderation gate lock poisoned");
         state.matcher = matcher;
         state.keyword_count = keyword_count;
         state.banned = snapshot.banned_session_keys.into_iter().collect();
-        state.allowed = snapshot.allowed_session_keys.into_iter().collect();
+        state.suppressed_hit_keys = Arc::new(suppressed_hit_keys);
+        state.resume_cursors = resume_cursors;
+        state.keyword_set_hash = keyword_set_hash;
         state.loaded = true;
         state.loaded_at_ms = Some(now_ms());
         Ok(())
@@ -198,7 +232,7 @@ impl ModerationGate {
                     tracing::debug!(
                         keyword_count = stats.keyword_count,
                         banned_session_count = stats.banned_session_count,
-                        allowed_session_count = stats.allowed_session_count,
+                        suppressed_hit_count = stats.suppressed_hit_count,
                         "moderation gate snapshot refreshed"
                     );
                 },
@@ -211,15 +245,12 @@ impl ModerationGate {
     }
 
     /// Whether the gate can affect any request. Dormant means loaded with no
-    /// keywords and no banned/allowlisted sessions, or not loaded yet — in
-    /// which case the hot path can skip all moderation work (session-key
-    /// derivation, text extraction, and scanning) entirely. This is a
-    /// benign check: if a keyword or ban lands between this call and the
-    /// scan, the next request picks it up.
+    /// keywords and no banned sessions, or not loaded yet — in which case the
+    /// hot path can skip all moderation work (session-key derivation, text
+    /// extraction, and scanning) entirely.
     pub(crate) fn is_active(&self) -> bool {
         let state = self.state.read().expect("moderation gate lock poisoned");
-        state.loaded
-            && (state.matcher.is_some() || !state.banned.is_empty() || !state.allowed.is_empty())
+        state.loaded && (state.matcher.is_some() || !state.banned.is_empty())
     }
 
     /// Classify one request before scanning.
@@ -232,12 +263,17 @@ impl ModerationGate {
             if state.banned.contains(session_key) {
                 return ModerationPrecheck::Blocked;
             }
-            if state.allowed.contains(session_key) {
-                return ModerationPrecheck::Skip;
-            }
         }
         match &state.matcher {
-            Some(matcher) => ModerationPrecheck::Scan(Arc::clone(matcher)),
+            Some(matcher) => ModerationPrecheck::Scan(ModerationScanPlan {
+                matcher: Arc::clone(matcher),
+                keyword_set_hash: state.keyword_set_hash.clone(),
+                suppressed_hit_keys: Arc::clone(&state.suppressed_hit_keys),
+                resume_cursors: session_key
+                    .and_then(|session_key| state.resume_cursors.get(session_key))
+                    .cloned()
+                    .unwrap_or_default(),
+            }),
             None => ModerationPrecheck::Skip,
         }
     }
@@ -286,18 +322,6 @@ impl ModerationGate {
         });
     }
 
-    /// Apply a reviewer decision to the in-memory sets without a full reload.
-    pub(crate) fn apply_review(&self, session_key: &str, banned: bool) {
-        let mut state = self.state.write().expect("moderation gate lock poisoned");
-        if banned {
-            state.allowed.remove(session_key);
-            state.banned.insert(session_key.to_string());
-        } else {
-            state.banned.remove(session_key);
-            state.allowed.insert(session_key.to_string());
-        }
-    }
-
     /// Runtime stats for the admin overview.
     pub(crate) fn stats(&self) -> ModerationGateStats {
         let state = self.state.read().expect("moderation gate lock poisoned");
@@ -306,7 +330,8 @@ impl ModerationGate {
             loaded_at_ms: state.loaded_at_ms,
             keyword_count: state.keyword_count,
             banned_session_count: state.banned.len(),
-            allowed_session_count: state.allowed.len(),
+            suppressed_hit_count: state.suppressed_hit_keys.len(),
+            resume_cursor_count: state.resume_cursors.values().map(Vec::len).sum(),
             blocked_requests_total: self.blocked_requests_total.load(Ordering::Relaxed),
             persist_failures_total: self.persist_failures_total.load(Ordering::Relaxed),
         }
@@ -315,7 +340,6 @@ impl ModerationGate {
 
 impl ModerationGateState {
     fn state_ban(&mut self, session_key: &str) -> bool {
-        self.allowed.remove(session_key);
         self.banned.insert(session_key.to_string())
     }
 }
@@ -349,7 +373,7 @@ pub(crate) struct ModerationRequest<'a> {
 /// Enforce the keyword moderation gate for one request, shared by every
 /// provider dispatch hook. `extract_text` yields the normalized text to scan
 /// and is invoked only when the gate must actually scan (keywords configured
-/// and the session is neither already banned nor allowlisted), so the caller
+/// and the session is not already banned), so the caller
 /// pays the extraction cost only when it can change the outcome. Returns
 /// [`ModerationDecision::Block`] when the request must be rejected.
 pub(crate) fn enforce_moderation(
@@ -373,13 +397,34 @@ pub(crate) fn enforce_moderation(
             gate.note_blocked_request();
             ModerationDecision::Block
         },
-        ModerationPrecheck::Scan(matcher) => {
+        ModerationPrecheck::Scan(plan) => {
             let scanned = extract_text();
-            let Some(hit) = matcher.find(&scanned) else {
+            let mut hit = match moderation_resume_start(
+                &plan.resume_cursors,
+                &scanned,
+                &plan.keyword_set_hash,
+            ) {
+                Some(start) => plan.matcher.find_from(&scanned, start),
+                None => plan.matcher.find(&scanned),
+            };
+            let Some((hit, hit_key)) = (loop {
+                let Some(candidate) = hit else {
+                    break None;
+                };
+                let candidate_hit_key = moderation_hit_key(&session_key, &scanned, &candidate);
+                if !plan.suppressed_hit_keys.contains(&candidate_hit_key) {
+                    break Some((candidate, candidate_hit_key));
+                }
+                hit = plan.matcher.find_after(&scanned, candidate.match_start);
+            }) else {
                 return ModerationDecision::Allow;
             };
+            let match_prefix_sha256 = moderation_match_prefix_sha256(&scanned, hit.match_start);
+            let match_start = hit.match_start.min(i64::MAX as usize) as i64;
+            let match_end = hit.match_end.min(i64::MAX as usize) as i64;
             gate.note_blocked_request();
             gate.ban_session(NewModerationBannedSession {
+                hit_key,
                 session_key,
                 provider: request.provider.to_string(),
                 key_id: request.key.key_id.clone(),
@@ -388,6 +433,10 @@ pub(crate) fn enforce_moderation(
                 matched_keyword: hit.keyword,
                 matched_categories: hit.categories,
                 matched_context: hit.context,
+                match_start,
+                match_end,
+                match_prefix_sha256,
+                keyword_set_hash: plan.keyword_set_hash,
                 endpoint: request.endpoint.to_string(),
                 model: request.model.to_string(),
                 client_ip: request.client_ip.to_string(),
@@ -406,6 +455,73 @@ pub(crate) fn moderation_session_key(provider: &str, key_id: &str, session_id: &
     format!("{provider}:{key_id}:{session_id}")
 }
 
+pub(crate) fn moderation_keyword_set_hash(keywords: &[ModerationKeyword]) -> String {
+    let mut normalized: Vec<&str> = keywords
+        .iter()
+        .map(|keyword| keyword.keyword.as_str())
+        .collect();
+    normalized.sort_unstable();
+    let mut hasher = Sha256::new();
+    for keyword in normalized {
+        hasher.update(keyword.as_bytes());
+        hasher.update([0]);
+    }
+    finish_sha256_hex(hasher)
+}
+
+pub(crate) fn moderation_match_prefix_sha256(normalized_text: &str, match_start: usize) -> String {
+    let end = match_start.min(normalized_text.len());
+    let mut hasher = Sha256::new();
+    hasher.update(&normalized_text.as_bytes()[..end]);
+    finish_sha256_hex(hasher)
+}
+
+pub(crate) fn moderation_hit_key(
+    session_key: &str,
+    normalized_text: &str,
+    hit: &ModerationMatch,
+) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(session_key.as_bytes());
+    hasher.update([0]);
+    hasher.update(hit.keyword.as_bytes());
+    hasher.update([0]);
+    hasher.update(hit.match_start.to_string().as_bytes());
+    hasher.update([0]);
+    hasher.update(hit.match_end.to_string().as_bytes());
+    hasher.update([0]);
+    hasher.update(moderation_match_prefix_sha256(normalized_text, hit.match_start).as_bytes());
+    finish_sha256_hex(hasher)
+}
+
+fn moderation_resume_cursor_from_hit(
+    hit: &ModerationSuppressedHit,
+) -> Option<ModerationResumeCursor> {
+    let match_start = usize::try_from(hit.match_start).ok()?;
+    Some(ModerationResumeCursor {
+        match_start,
+        match_prefix_sha256: hit.match_prefix_sha256.clone(),
+        keyword_set_hash: hit.keyword_set_hash.clone(),
+    })
+}
+
+fn moderation_resume_start(
+    cursors: &[ModerationResumeCursor],
+    normalized_text: &str,
+    keyword_set_hash: &str,
+) -> Option<usize> {
+    cursors
+        .iter()
+        .filter(|cursor| cursor.keyword_set_hash == keyword_set_hash)
+        .filter(|cursor| cursor.match_start <= normalized_text.len())
+        .filter(|cursor| {
+            moderation_match_prefix_sha256(normalized_text, cursor.match_start)
+                == cursor.match_prefix_sha256
+        })
+        .map(|cursor| cursor.match_start)
+        .max()
+}
+
 /// Derive a stable content-scoped ban key for requests without any session id
 /// so identical retries are deduplicated in memory and by the store conflict.
 pub(crate) fn derived_moderation_session_key(provider: &str, key_id: &str, body: &[u8]) -> String {
@@ -419,6 +535,15 @@ pub(crate) fn derived_moderation_session_key(provider: &str, key_id: &str, body:
     format!("{provider}:{key_id}:content:{preview}")
 }
 
+fn finish_sha256_hex(hasher: Sha256) -> String {
+    let digest = hasher.finalize();
+    let mut out = String::with_capacity(digest.len() * 2);
+    for byte in digest {
+        write!(&mut out, "{byte:02x}").expect("write to string");
+    }
+    out
+}
+
 /// Serialize request headers to a JSON object with sensitive values redacted.
 pub(crate) fn redacted_headers_json(headers: &HeaderMap) -> String {
     let mut map = serde_json::Map::new();
@@ -515,11 +640,158 @@ fn now_ms() -> i64 {
 
 #[cfg(test)]
 mod tests {
+    use std::sync::Mutex;
+
+    use async_trait::async_trait;
     use axum::http::{HeaderMap, HeaderValue};
+    use llm_access_core::store::{
+        AdminPageRequest, ModerationBannedSession, ModerationBannedSessionDetail,
+        ModerationBannedSessionsPage, ModerationCategory, ModerationKeyword,
+        ModerationKeywordImportOutcome, ModerationRuntimeSnapshot, ModerationSuppressedHit,
+        NewModerationCategory, NewModerationKeyword,
+    };
     use serde_json::json;
 
     use super::*;
 
+    #[derive(Default)]
+    struct MemoryModerationStore {
+        snapshot: Mutex<ModerationRuntimeSnapshot>,
+        records: Mutex<Vec<NewModerationBannedSession>>,
+    }
+
+    impl MemoryModerationStore {
+        fn with_snapshot(snapshot: ModerationRuntimeSnapshot) -> Self {
+            Self {
+                snapshot: Mutex::new(snapshot),
+                records: Mutex::new(Vec::new()),
+            }
+        }
+
+        fn records(&self) -> Vec<NewModerationBannedSession> {
+            self.records.lock().expect("records lock").clone()
+        }
+    }
+
+    #[async_trait]
+    impl AdminModerationStore for MemoryModerationStore {
+        async fn load_moderation_runtime_snapshot(
+            &self,
+        ) -> anyhow::Result<ModerationRuntimeSnapshot> {
+            Ok(self.snapshot.lock().expect("snapshot lock").clone())
+        }
+
+        async fn list_moderation_categories(&self) -> anyhow::Result<Vec<ModerationCategory>> {
+            Ok(Vec::new())
+        }
+
+        async fn add_moderation_categories(
+            &self,
+            _categories: Vec<NewModerationCategory>,
+        ) -> anyhow::Result<usize> {
+            Ok(0)
+        }
+
+        async fn delete_moderation_category(
+            &self,
+            _code: &str,
+        ) -> anyhow::Result<Option<ModerationCategory>> {
+            Ok(None)
+        }
+
+        async fn list_moderation_keywords(&self) -> anyhow::Result<Vec<ModerationKeyword>> {
+            Ok(self
+                .snapshot
+                .lock()
+                .expect("snapshot lock")
+                .keywords
+                .clone())
+        }
+
+        async fn add_moderation_keywords(
+            &self,
+            _keywords: Vec<NewModerationKeyword>,
+        ) -> anyhow::Result<ModerationKeywordImportOutcome> {
+            Ok(ModerationKeywordImportOutcome::default())
+        }
+
+        async fn delete_moderation_keyword(
+            &self,
+            _id: i64,
+        ) -> anyhow::Result<Option<ModerationKeyword>> {
+            Ok(None)
+        }
+
+        async fn record_moderation_banned_session(
+            &self,
+            record: NewModerationBannedSession,
+        ) -> anyhow::Result<bool> {
+            let mut records = self.records.lock().expect("records lock");
+            if records
+                .iter()
+                .any(|existing| existing.hit_key == record.hit_key)
+            {
+                return Ok(false);
+            }
+            records.push(record);
+            Ok(true)
+        }
+
+        async fn list_moderation_banned_sessions(
+            &self,
+            page: AdminPageRequest,
+            _status: Option<&str>,
+        ) -> anyhow::Result<ModerationBannedSessionsPage> {
+            Ok(ModerationBannedSessionsPage {
+                sessions: Vec::new(),
+                total: 0,
+                limit: page.limit,
+                offset: page.offset,
+                has_more: false,
+            })
+        }
+
+        async fn get_moderation_banned_session(
+            &self,
+            _id: i64,
+        ) -> anyhow::Result<Option<ModerationBannedSessionDetail>> {
+            Ok(None)
+        }
+
+        async fn set_moderation_banned_session_status(
+            &self,
+            _id: i64,
+            _status: &str,
+            _review_note: Option<&str>,
+            _reviewed_at_ms: i64,
+        ) -> anyhow::Result<Option<ModerationBannedSession>> {
+            Ok(None)
+        }
+    }
+
+    fn moderation_keyword(id: i64, keyword: &str) -> ModerationKeyword {
+        ModerationKeyword {
+            id,
+            keyword: keyword.to_string(),
+            categories: Vec::new(),
+            note: None,
+            source: "txt".to_string(),
+            created_at_ms: 1,
+        }
+    }
+
+    fn sample_key() -> AuthenticatedKey {
+        AuthenticatedKey {
+            key_id: "key-1".to_string(),
+            key_name: "external".to_string(),
+            provider_type: "kiro".to_string(),
+            protocol_family: "anthropic".to_string(),
+            status: "active".to_string(),
+            quota_billable_limit: 0,
+            billable_tokens_used: 0,
+        }
+    }
+
     #[test]
     fn session_key_uses_provider_key_and_session() {
         assert_eq!(
@@ -596,4 +868,141 @@ mod tests {
         assert_eq!(stats.keyword_count, 0);
         assert!(stats.loaded);
     }
+
+    #[tokio::test]
+    async fn unbanned_hit_resumes_scan_and_blocks_later_hit_in_same_session() {
+        let keywords =
+            vec![moderation_keyword(1, "build a bomb"), moderation_keyword(2, "carding tutorial")];
+        let keyword_set_hash = moderation_keyword_set_hash(&keywords);
+        let text = normalize_moderation_text(
+            "reviewed false positive: build a bomb. New content asks for carding tutorial.",
+        );
+        let matcher = ModerationMatcher::build(
+            keywords
+                .iter()
+                .map(|keyword| (keyword.keyword.as_str(), keyword.categories.clone())),
+        )
+        .expect("build matcher")
+        .expect("matcher");
+        let reviewed_hit = matcher.find(&text).expect("reviewed hit");
+        assert_eq!(reviewed_hit.keyword, "build a bomb");
+
+        let session_key = moderation_session_key(MODERATION_PROVIDER_KIRO, "key-1", "sess-1");
+        let reviewed_hit_key = moderation_hit_key(&session_key, &text, &reviewed_hit);
+        let store = Arc::new(MemoryModerationStore::with_snapshot(ModerationRuntimeSnapshot {
+            keywords,
+            banned_session_keys: Vec::new(),
+            suppressed_hits: vec![ModerationSuppressedHit {
+                session_key: session_key.clone(),
+                hit_key: reviewed_hit_key.clone(),
+                match_start: reviewed_hit.match_start as i64,
+                match_end: reviewed_hit.match_end as i64,
+                match_prefix_sha256: moderation_match_prefix_sha256(
+                    &text,
+                    reviewed_hit.match_start,
+                ),
+                keyword_set_hash,
+            }],
+        }));
+        let gate = ModerationGate::new(store.clone());
+        gate.reload().await.expect("load moderation snapshot");
+
+        let headers = HeaderMap::new();
+        let key = sample_key();
+        let decision = enforce_moderation(
+            &gate,
+            ModerationRequest {
+                provider: MODERATION_PROVIDER_KIRO,
+                key: &key,
+                session_id: Some("sess-1"),
+                endpoint: "/v1/messages",
+                model: "claude-sonnet-4",
+                headers: &headers,
+                body: b"{}",
+                client_ip: "127.0.0.1",
+            },
+            || text.clone(),
+        );
+        assert!(matches!(decision, ModerationDecision::Block));
+
+        for _ in 0..20 {
+            if !store.records().is_empty() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        let records = store.records();
+        assert_eq!(records.len(), 1);
+        assert_eq!(records[0].session_key, session_key);
+        assert_eq!(records[0].matched_keyword, "carding tutorial");
+        assert_ne!(records[0].hit_key, reviewed_hit_key);
+        assert!(records[0].match_start > reviewed_hit.match_start as i64);
+    }
+
+    #[tokio::test]
+    async fn changed_keyword_at_reviewed_position_is_not_suppressed() {
+        let keywords =
+            vec![moderation_keyword(1, "build a bomb"), moderation_keyword(2, "carding tutorial")];
+        let keyword_set_hash = moderation_keyword_set_hash(&keywords);
+        let reviewed_text = normalize_moderation_text("reviewed false positive: build a bomb");
+        let changed_text = normalize_moderation_text("reviewed false positive: carding tutorial");
+        let matcher = ModerationMatcher::build(
+            keywords
+                .iter()
+                .map(|keyword| (keyword.keyword.as_str(), keyword.categories.clone())),
+        )
+        .expect("build matcher")
+        .expect("matcher");
+        let reviewed_hit = matcher.find(&reviewed_text).expect("reviewed hit");
+        assert_eq!(reviewed_hit.keyword, "build a bomb");
+
+        let session_key = moderation_session_key(MODERATION_PROVIDER_KIRO, "key-1", "sess-1");
+        let reviewed_hit_key = moderation_hit_key(&session_key, &reviewed_text, &reviewed_hit);
+        let store = Arc::new(MemoryModerationStore::with_snapshot(ModerationRuntimeSnapshot {
+            keywords,
+            banned_session_keys: Vec::new(),
+            suppressed_hits: vec![ModerationSuppressedHit {
+                session_key: session_key.clone(),
+                hit_key: reviewed_hit_key,
+                match_start: reviewed_hit.match_start as i64,
+                match_end: reviewed_hit.match_end as i64,
+                match_prefix_sha256: moderation_match_prefix_sha256(
+                    &reviewed_text,
+                    reviewed_hit.match_start,
+                ),
+                keyword_set_hash,
+            }],
+        }));
+        let gate = ModerationGate::new(store.clone());
+        gate.reload().await.expect("load moderation snapshot");
+
+        let headers = HeaderMap::new();
+        let key = sample_key();
+        let decision = enforce_moderation(
+            &gate,
+            ModerationRequest {
+                provider: MODERATION_PROVIDER_KIRO,
+                key: &key,
+                session_id: Some("sess-1"),
+                endpoint: "/v1/messages",
+                model: "claude-sonnet-4",
+                headers: &headers,
+                body: b"{}",
+                client_ip: "127.0.0.1",
+            },
+            || changed_text.clone(),
+        );
+        assert!(matches!(decision, ModerationDecision::Block));
+
+        for _ in 0..20 {
+            if !store.records().is_empty() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        let records = store.records();
+        assert_eq!(records.len(), 1);
+        assert_eq!(records[0].matched_keyword, "carding tutorial");
+        assert_eq!(records[0].match_start, reviewed_hit.match_start as i64);
+    }
 }

From 1f7b9a0c3342feb668cbf2d066a7c5a32d6cbfe9 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 20:48:51 +0800
Subject: [PATCH 09/11] fix(llm-access): close hit-scoped moderation unban
 bypasses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review of the hit-scoped unban surfaced correctness bugs; fixes:

1. [blocker] Suppression bypass: the resume loop advanced by match_start
   (find_after, exclusive on start), which discards EVERY hit at that
   offset — including a DISTINCT unsuppressed keyword sharing the start
   (e.g. `bomb` and `bomb making`, or `习`/`习近`). Unbanning the shorter
   one silently masked the longer one. Replace the position-based resume
   scan with ModerationMatcher::find_accepted: one overlapping scan from 0
   that skips only suppressed hit_keys, so co-located keywords are each
   evaluated. Drops the unsafe resume-cursor scan-skip (it could also miss
   a longer keyword starting before a cursor); per-hit content-scoping is
   preserved via the prefix hash folded into hit_key. Regression test added.

2. [major] Drop the partial UNIQUE index on (session_key) WHERE
   status='banned' — it enforced one active ban per session, contradicting
   the multi-hit model and 500ing when re-banning a reviewed hit. Per-hit
   uniqueness is already covered by hit_key UNIQUE.

3. [minor] record_moderation_banned_session now uses ON CONFLICT (hit_key)
   DO NOTHING so a distinct new hit in an already-banned session is captured
   rather than silently swallowed by the dropped index's conflict.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/frontend/src/api.rs                    |   1 -
 crates/llm-access-core/src/moderation.rs      |  34 +++
 .../postgres/0036_keyword_moderation.sql      |   8 +-
 .../src/postgres/moderation.rs                |   2 +-
 crates/llm-access/src/moderation.rs           | 204 ++++++++++--------
 5 files changed, 159 insertions(+), 90 deletions(-)

diff --git a/crates/frontend/src/api.rs b/crates/frontend/src/api.rs
index f0a99aba..15ad6309 100644
--- a/crates/frontend/src/api.rs
+++ b/crates/frontend/src/api.rs
@@ -11015,7 +11015,6 @@ pub struct ModerationGateStatsView {
     pub keyword_count: usize,
     pub banned_session_count: usize,
     pub suppressed_hit_count: usize,
-    pub resume_cursor_count: usize,
     pub blocked_requests_total: u64,
     pub persist_failures_total: u64,
 }
diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
index cf822974..951a4823 100644
--- a/crates/llm-access-core/src/moderation.rs
+++ b/crates/llm-access-core/src/moderation.rs
@@ -171,6 +171,40 @@ impl ModerationMatcher {
         )
     }
 
+    /// Scan the whole text and return the first term-boundary-aligned hit that
+    /// `accept(keyword, match_start, match_end)` returns true for. Unlike
+    /// [`Self::find_after`], this enumerates *every* overlapping hit —
+    /// including several distinct keywords that share a start offset (a
+    /// phrase-prefix and its superstring) — so a caller can skip specific
+    /// hits by identity without missing a co-located keyword. `accept` is
+    /// evaluated cheaply per candidate; the full [`ModerationMatch`] (with
+    /// its context snippet) is built only for the accepted hit.
+    pub fn find_accepted(
+        &self,
+        normalized_text: &str,
+        accept: impl Fn(&str, usize, usize) -> bool,
+    ) -> Option<ModerationMatch> {
+        let haystack = normalized_text.as_bytes();
+        for candidate in self.automaton.find_overlapping_iter(normalized_text) {
+            let start = candidate.start();
+            let end = candidate.end();
+            if !match_on_term_boundaries(haystack, start, end) {
+                continue;
+            }
+            let index = candidate.pattern().as_usize();
+            if accept(&self.patterns[index], start, end) {
+                return Some(ModerationMatch {
+                    keyword: self.patterns[index].clone(),
+                    categories: self.categories[index].clone(),
+                    match_start: start,
+                    match_end: end,
+                    context: match_context_snippet(normalized_text, start, end),
+                });
+            }
+        }
+        None
+    }
+
     fn find_inner(
         &self,
         normalized_text: &str,
diff --git a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
index c88fdfff..acbb52b4 100644
--- a/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
+++ b/crates/llm-access-migrations/migrations/postgres/0036_keyword_moderation.sql
@@ -56,6 +56,8 @@ CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_banned_at
 CREATE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_key_id
     ON llm_moderation_banned_sessions(key_id, banned_at_ms DESC);
 
-CREATE UNIQUE INDEX IF NOT EXISTS idx_llm_moderation_banned_sessions_active_session
-    ON llm_moderation_banned_sessions(session_key)
-    WHERE status = 'banned';
+-- A session may hold several ban rows over time (one per distinct keyword hit,
+-- as content is reviewed and later content re-scanned). Uniqueness is per hit
+-- (hit_key UNIQUE); the runtime derives per-session banned state via
+-- SELECT DISTINCT session_key WHERE status = 'banned'. There is deliberately no
+-- unique constraint on session_key.
diff --git a/crates/llm-access-store/src/postgres/moderation.rs b/crates/llm-access-store/src/postgres/moderation.rs
index 07f6c14a..1773f0bb 100644
--- a/crates/llm-access-store/src/postgres/moderation.rs
+++ b/crates/llm-access-store/src/postgres/moderation.rs
@@ -334,7 +334,7 @@ impl AdminModerationStore for PostgresControlRepository {
                  )
                  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
                          $13, $14, $15, $16, $17, $18::jsonb, 'banned', $19, $19)
-                 ON CONFLICT DO NOTHING",
+                 ON CONFLICT (hit_key) DO NOTHING",
                 &[
                     &record.hit_key,
                     &record.session_key,
diff --git a/crates/llm-access/src/moderation.rs b/crates/llm-access/src/moderation.rs
index ebdc7b31..62510440 100644
--- a/crates/llm-access/src/moderation.rs
+++ b/crates/llm-access/src/moderation.rs
@@ -15,7 +15,6 @@
 //!   ┌──────────────────── in process memory (RwLock<ModerationGateState>) ────────────────┐
 //!   │  matcher : Aho-Corasick automaton compiled from every keyword                        │
 //!   │  banned  : HashSet<session_key>     suppressed_hit_keys : HashSet<hit_key>            │
-//!   │  resume_cursors : HashMap<session_key, Vec<reviewed hit position>>                    │
 //!   └─────────────────────────────────────────────────────────────────────────────────────┘
 //!        ▲ reload(): full snapshot  — startup, every N minutes, and after any admin change
 //!        │ ban_session(): ONE spawned INSERT per new ban (body + headers), off the hot path
@@ -46,9 +45,9 @@
 //!   precheck(session_key)
 //!     ├── Blocked  (session already banned) ─────────▶ BLOCK   (no scan, no DB write)
 //!     ├── Skip     (no keywords) ───────────────────▶ ALLOW
-//!     └── Scan(automaton + suppressed hit keys + cursors)
+//!     └── Scan(automaton + suppressed hit keys)
 //!            │
-//!            ▼  extract user-visible text ─▶ tokenize ─▶ resume/scan (see llm_access_core)
+//!            ▼  extract user-visible text ─▶ tokenize ─▶ scan, skipping suppressed hit_keys
 //!          unsuppressed hit? ──no──▶ ALLOW
 //!            │ yes
 //!            ▼  ban_session(): insert into `banned` (memory) + spawn one Postgres capture
@@ -57,13 +56,15 @@
 //!
 //! A `BLOCK` decision stops this and every subsequent request for the session:
 //! the key is now in the in-memory `banned` set, so the next request short-
-//! circuits at `precheck` without touching the body or Postgres. A reviewer
-//! reviews the hit as `unbanned` via the admin API, the next snapshot treats
-//! that hit position as suppressed; later content in the same session can still
-//! be scanned and banned.
+//! circuits at `precheck` without touching the body or Postgres. When a
+//! reviewer reviews a hit as `unbanned` via the admin API, that hit's `hit_key`
+//! becomes suppressed; the session leaves the `banned` set and is re-scanned,
+//! and the scan skips only that exact hit (by identity, folding in the content
+//! prefix), so a distinct keyword — even one sharing the same offset — and
+//! later content can still be scanned and banned.
 
 use std::{
-    collections::{HashMap, HashSet},
+    collections::HashSet,
     fmt::Write as _,
     sync::{
         atomic::{AtomicU64, Ordering},
@@ -79,7 +80,7 @@ use llm_access_core::{
     },
     store::{
         AdminModerationStore, AuthenticatedKey, EmptyAdminModerationStore, ModerationKeyword,
-        ModerationSuppressedHit, NewModerationBannedSession,
+        NewModerationBannedSession,
     },
 };
 use llm_access_kiro::anthropic::types::MessagesRequest;
@@ -118,14 +119,6 @@ pub(crate) struct ModerationScanPlan {
     matcher: Arc<ModerationMatcher>,
     keyword_set_hash: String,
     suppressed_hit_keys: Arc<HashSet<String>>,
-    resume_cursors: Vec<ModerationResumeCursor>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-struct ModerationResumeCursor {
-    match_start: usize,
-    match_prefix_sha256: String,
-    keyword_set_hash: String,
 }
 
 #[derive(Default)]
@@ -134,7 +127,6 @@ struct ModerationGateState {
     keyword_count: usize,
     banned: HashSet<String>,
     suppressed_hit_keys: Arc<HashSet<String>>,
-    resume_cursors: HashMap<String, Vec<ModerationResumeCursor>>,
     keyword_set_hash: String,
     loaded: bool,
     loaded_at_ms: Option<i64>,
@@ -148,7 +140,6 @@ pub(crate) struct ModerationGateStats {
     pub keyword_count: usize,
     pub banned_session_count: usize,
     pub suppressed_hit_count: usize,
-    pub resume_cursor_count: usize,
     pub blocked_requests_total: u64,
     pub persist_failures_total: u64,
 }
@@ -198,23 +189,16 @@ impl ModerationGate {
             .as_ref()
             .map(|matcher| matcher.pattern_count())
             .unwrap_or(0);
-        let mut suppressed_hit_keys = HashSet::with_capacity(snapshot.suppressed_hits.len());
-        let mut resume_cursors: HashMap<String, Vec<ModerationResumeCursor>> = HashMap::new();
-        for hit in snapshot.suppressed_hits {
-            suppressed_hit_keys.insert(hit.hit_key.clone());
-            if let Some(cursor) = moderation_resume_cursor_from_hit(&hit) {
-                resume_cursors
-                    .entry(hit.session_key)
-                    .or_default()
-                    .push(cursor);
-            }
-        }
+        let suppressed_hit_keys: HashSet<String> = snapshot
+            .suppressed_hits
+            .into_iter()
+            .map(|hit| hit.hit_key)
+            .collect();
         let mut state = self.state.write().expect("moderation gate lock poisoned");
         state.matcher = matcher;
         state.keyword_count = keyword_count;
         state.banned = snapshot.banned_session_keys.into_iter().collect();
         state.suppressed_hit_keys = Arc::new(suppressed_hit_keys);
-        state.resume_cursors = resume_cursors;
         state.keyword_set_hash = keyword_set_hash;
         state.loaded = true;
         state.loaded_at_ms = Some(now_ms());
@@ -269,10 +253,6 @@ impl ModerationGate {
                 matcher: Arc::clone(matcher),
                 keyword_set_hash: state.keyword_set_hash.clone(),
                 suppressed_hit_keys: Arc::clone(&state.suppressed_hit_keys),
-                resume_cursors: session_key
-                    .and_then(|session_key| state.resume_cursors.get(session_key))
-                    .cloned()
-                    .unwrap_or_default(),
             }),
             None => ModerationPrecheck::Skip,
         }
@@ -331,7 +311,6 @@ impl ModerationGate {
             keyword_count: state.keyword_count,
             banned_session_count: state.banned.len(),
             suppressed_hit_count: state.suppressed_hit_keys.len(),
-            resume_cursor_count: state.resume_cursors.values().map(Vec::len).sum(),
             blocked_requests_total: self.blocked_requests_total.load(Ordering::Relaxed),
             persist_failures_total: self.persist_failures_total.load(Ordering::Relaxed),
         }
@@ -399,26 +378,21 @@ pub(crate) fn enforce_moderation(
         },
         ModerationPrecheck::Scan(plan) => {
             let scanned = extract_text();
-            let mut hit = match moderation_resume_start(
-                &plan.resume_cursors,
-                &scanned,
-                &plan.keyword_set_hash,
-            ) {
-                Some(start) => plan.matcher.find_from(&scanned, start),
-                None => plan.matcher.find(&scanned),
-            };
-            let Some((hit, hit_key)) = (loop {
-                let Some(candidate) = hit else {
-                    break None;
-                };
-                let candidate_hit_key = moderation_hit_key(&session_key, &scanned, &candidate);
-                if !plan.suppressed_hit_keys.contains(&candidate_hit_key) {
-                    break Some((candidate, candidate_hit_key));
-                }
-                hit = plan.matcher.find_after(&scanned, candidate.match_start);
+            // Enumerate every term-boundary hit and block on the first whose
+            // hit_key is NOT suppressed. Suppression is per hit identity, so two
+            // distinct keywords sharing a start offset (a phrase-prefix and its
+            // superstring) are each evaluated — clearing one never masks the
+            // other. A suppressed hit is skipped only for the exact preceding
+            // content it was reviewed in, because its hit_key folds in the
+            // content prefix hash.
+            let Some(hit) = plan.matcher.find_accepted(&scanned, |keyword, start, end| {
+                let candidate_hit_key =
+                    moderation_hit_key_parts(&session_key, &scanned, keyword, start, end);
+                !plan.suppressed_hit_keys.contains(&candidate_hit_key)
             }) else {
                 return ModerationDecision::Allow;
             };
+            let hit_key = moderation_hit_key(&session_key, &scanned, &hit);
             let match_prefix_sha256 = moderation_match_prefix_sha256(&scanned, hit.match_start);
             let match_start = hit.match_start.min(i64::MAX as usize) as i64;
             let match_end = hit.match_end.min(i64::MAX as usize) as i64;
@@ -480,48 +454,40 @@ pub(crate) fn moderation_hit_key(
     session_key: &str,
     normalized_text: &str,
     hit: &ModerationMatch,
+) -> String {
+    moderation_hit_key_parts(
+        session_key,
+        normalized_text,
+        &hit.keyword,
+        hit.match_start,
+        hit.match_end,
+    )
+}
+
+/// Stable identity of one keyword hit: which session, which keyword, where, and
+/// the hash of the preceding content — so the same reviewed hit stays
+/// suppressed only while its preceding context is byte-identical, and distinct
+/// keywords at the same offset get distinct keys.
+pub(crate) fn moderation_hit_key_parts(
+    session_key: &str,
+    normalized_text: &str,
+    keyword: &str,
+    match_start: usize,
+    match_end: usize,
 ) -> String {
     let mut hasher = Sha256::new();
     hasher.update(session_key.as_bytes());
     hasher.update([0]);
-    hasher.update(hit.keyword.as_bytes());
+    hasher.update(keyword.as_bytes());
     hasher.update([0]);
-    hasher.update(hit.match_start.to_string().as_bytes());
+    hasher.update(match_start.to_string().as_bytes());
     hasher.update([0]);
-    hasher.update(hit.match_end.to_string().as_bytes());
+    hasher.update(match_end.to_string().as_bytes());
     hasher.update([0]);
-    hasher.update(moderation_match_prefix_sha256(normalized_text, hit.match_start).as_bytes());
+    hasher.update(moderation_match_prefix_sha256(normalized_text, match_start).as_bytes());
     finish_sha256_hex(hasher)
 }
 
-fn moderation_resume_cursor_from_hit(
-    hit: &ModerationSuppressedHit,
-) -> Option<ModerationResumeCursor> {
-    let match_start = usize::try_from(hit.match_start).ok()?;
-    Some(ModerationResumeCursor {
-        match_start,
-        match_prefix_sha256: hit.match_prefix_sha256.clone(),
-        keyword_set_hash: hit.keyword_set_hash.clone(),
-    })
-}
-
-fn moderation_resume_start(
-    cursors: &[ModerationResumeCursor],
-    normalized_text: &str,
-    keyword_set_hash: &str,
-) -> Option<usize> {
-    cursors
-        .iter()
-        .filter(|cursor| cursor.keyword_set_hash == keyword_set_hash)
-        .filter(|cursor| cursor.match_start <= normalized_text.len())
-        .filter(|cursor| {
-            moderation_match_prefix_sha256(normalized_text, cursor.match_start)
-                == cursor.match_prefix_sha256
-        })
-        .map(|cursor| cursor.match_start)
-        .max()
-}
-
 /// Derive a stable content-scoped ban key for requests without any session id
 /// so identical retries are deduplicated in memory and by the store conflict.
 pub(crate) fn derived_moderation_session_key(provider: &str, key_id: &str, body: &[u8]) -> String {
@@ -1005,4 +971,72 @@ mod tests {
         assert_eq!(records[0].matched_keyword, "carding tutorial");
         assert_eq!(records[0].match_start, reviewed_hit.match_start as i64);
     }
+
+    #[tokio::test]
+    async fn co_located_keyword_still_blocks_after_sibling_unbanned() {
+        // "bomb" and "bomb making" hit the SAME start offset. Unbanning the
+        // shorter one must not mask the distinct longer one (regression for the
+        // suppression-advance-by-offset bypass).
+        let keywords = vec![moderation_keyword(1, "bomb"), moderation_keyword(2, "bomb making")];
+        let keyword_set_hash = moderation_keyword_set_hash(&keywords);
+        let text = normalize_moderation_text("here is bomb making guide");
+        let matcher = ModerationMatcher::build(
+            keywords
+                .iter()
+                .map(|keyword| (keyword.keyword.as_str(), keyword.categories.clone())),
+        )
+        .expect("build matcher")
+        .expect("matcher");
+        // find() returns the shortest-end hit first: "bomb". Suppress exactly it.
+        let bomb_hit = matcher.find(&text).expect("bomb hit");
+        assert_eq!(bomb_hit.keyword, "bomb");
+
+        let session_key = moderation_session_key(MODERATION_PROVIDER_KIRO, "key-1", "sess-1");
+        let bomb_hit_key = moderation_hit_key(&session_key, &text, &bomb_hit);
+        let store = Arc::new(MemoryModerationStore::with_snapshot(ModerationRuntimeSnapshot {
+            keywords,
+            banned_session_keys: Vec::new(),
+            suppressed_hits: vec![ModerationSuppressedHit {
+                session_key: session_key.clone(),
+                hit_key: bomb_hit_key.clone(),
+                match_start: bomb_hit.match_start as i64,
+                match_end: bomb_hit.match_end as i64,
+                match_prefix_sha256: moderation_match_prefix_sha256(&text, bomb_hit.match_start),
+                keyword_set_hash,
+            }],
+        }));
+        let gate = ModerationGate::new(store.clone());
+        gate.reload().await.expect("load moderation snapshot");
+
+        let headers = HeaderMap::new();
+        let key = sample_key();
+        let decision = enforce_moderation(
+            &gate,
+            ModerationRequest {
+                provider: MODERATION_PROVIDER_KIRO,
+                key: &key,
+                session_id: Some("sess-1"),
+                endpoint: "/v1/messages",
+                model: "claude-sonnet-4",
+                headers: &headers,
+                body: b"{}",
+                client_ip: "127.0.0.1",
+            },
+            || text.clone(),
+        );
+        assert!(matches!(decision, ModerationDecision::Block));
+
+        for _ in 0..20 {
+            if !store.records().is_empty() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        let records = store.records();
+        assert_eq!(records.len(), 1);
+        // The distinct co-located keyword must be the one that blocks.
+        assert_eq!(records[0].matched_keyword, "bomb making");
+        assert_eq!(records[0].match_start, bomb_hit.match_start as i64);
+        assert_ne!(records[0].hit_key, bomb_hit_key);
+    }
 }

From e80df76799e742b92ef729b244e808fa76fd7c96 Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 20:51:44 +0800
Subject: [PATCH 10/11] docs(llm-access): explain hit-scoped unban design and
 the bypass fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Document, in code, why moderation suppression must skip by hit identity
rather than by scan position:
- A new module-doc section "Hit-scoped unban" spells out what hit_key is
  (session + keyword + offsets + preceding-content hash), why the content
  prefix makes suppression fail-closed on any content change, and a
  WRONG-vs-RIGHT diagram showing how position-based skipping lets a distinct
  keyword sharing a suppressed hit's start offset (bomb / bomb making) slip
  through — the bypass fixed by find_accepted.
- find_accepted's rustdoc explains it exists precisely to avoid that bypass.

Comments only; no behavior change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/llm-access-core/src/moderation.rs |  8 +++++
 crates/llm-access/src/moderation.rs      | 44 +++++++++++++++++++++++-
 2 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
index 951a4823..dfd42186 100644
--- a/crates/llm-access-core/src/moderation.rs
+++ b/crates/llm-access-core/src/moderation.rs
@@ -179,6 +179,14 @@ impl ModerationMatcher {
     /// hits by identity without missing a co-located keyword. `accept` is
     /// evaluated cheaply per candidate; the full [`ModerationMatch`] (with
     /// its context snippet) is built only for the accepted hit.
+    ///
+    /// This exists for the moderation gate's hit-scoped suppression: skipping a
+    /// scan *by offset* (as [`Self::find_after`] does) would discard a
+    /// distinct, unsuppressed keyword that happens to start at the same
+    /// offset as a suppressed one — a content-policy bypass. Filtering by
+    /// hit identity via `accept` avoids that; `find_overlapping_iter`
+    /// reports the shorter match at a shared start first, so `accept` sees
+    /// each candidate.
     pub fn find_accepted(
         &self,
         normalized_text: &str,
diff --git a/crates/llm-access/src/moderation.rs b/crates/llm-access/src/moderation.rs
index 62510440..4cb373da 100644
--- a/crates/llm-access/src/moderation.rs
+++ b/crates/llm-access/src/moderation.rs
@@ -62,6 +62,47 @@
 //! and the scan skips only that exact hit (by identity, folding in the content
 //! prefix), so a distinct keyword — even one sharing the same offset — and
 //! later content can still be scanned and banned.
+//!
+//! # Hit-scoped unban: why we skip by hit identity, not by position
+//!
+//! A ban is scoped to one *hit*, not the whole session, so a reviewer clearing
+//! a single false positive neither unblocks the session wholesale nor masks
+//! other matches. A hit's identity is `hit_key`
+//! (`moderation_hit_key` = `sha256(session_key ∥ keyword ∥ start ∥ end ∥
+//! sha256(text_prefix))`). Reviewing a hit as `unbanned` records its `hit_key`
+//! in the `suppressed_hit_keys` set. Folding the *preceding-content* hash into
+//! the key makes suppression fail-closed on any content change: if the text
+//! before the match differs by a single byte, the `hit_key` differs and the hit
+//! re-fires. Including the keyword and offsets makes two matches at the same
+//! place distinct keys.
+//!
+//! The scan therefore enumerates *every* term-boundary hit
+//! ([`ModerationMatcher::find_accepted`]) and blocks on the first whose
+//! `hit_key` is **not** suppressed. It deliberately does **not** try to resume
+//! the scan past a reviewed position, because position-based skipping is a
+//! content-policy bypass (fail-open) when keywords overlap:
+//!
+//! ```text
+//!   keywords: "bomb", "bomb making"         request text: "... bomb making ..."
+//!   both hit the SAME start offset S (one is a term-prefix of the other).
+//!
+//!   WRONG (skip by position): unban "bomb"@S ⇒ suppressed.
+//!     next scan finds "bomb"@S (suppressed) ⇒ advance past offset S ⇒
+//!     the DISTINCT, never-reviewed "bomb making"@S is skipped too ⇒ ALLOW ✗
+//!     (a longer keyword *starting before* a resumed offset is skipped the
+//!      same way.)
+//!
+//!   RIGHT (skip by hit_key): unban "bomb"@S ⇒ only hit_key(bomb@S) suppressed.
+//!     next scan enumerates both hits at S; "bomb"@S is suppressed, but
+//!     "bomb making"@S has a different hit_key ⇒ BLOCK ✓
+//! ```
+//!
+//! A session with any still-`banned` hit stays in the `banned` set (blocked at
+//! `precheck`); only when *all* its hits are `unbanned` does the store's
+//! `SELECT DISTINCT session_key WHERE status = 'banned'` drop it and let the
+//! gate re-scan. Because a session can therefore accumulate several ban rows
+//! over time, uniqueness is per hit (`hit_key UNIQUE`), never per
+//! `session_key`.
 
 use std::{
     collections::HashSet,
@@ -384,7 +425,8 @@ pub(crate) fn enforce_moderation(
             // superstring) are each evaluated — clearing one never masks the
             // other. A suppressed hit is skipped only for the exact preceding
             // content it was reviewed in, because its hit_key folds in the
-            // content prefix hash.
+            // content prefix hash. See the module-level "Hit-scoped unban"
+            // section for why this must skip by hit_key, not by scan position.
             let Some(hit) = plan.matcher.find_accepted(&scanned, |keyword, start, end| {
                 let candidate_hit_key =
                     moderation_hit_key_parts(&session_key, &scanned, keyword, start, end);

From e5830850e1909851811b9aa56f9e8fbd8d8153ff Mon Sep 17 00:00:00 2001
From: LB7666 <acking-you@foxmail.com>
Date: Sat, 4 Jul 2026 22:05:23 +0800
Subject: [PATCH 11/11] docs(llm-access): align moderation hit suppression
 comments

---
 crates/llm-access-core/src/moderation.rs       | 4 ++--
 crates/llm-access-core/src/store/moderation.rs | 8 ++++----
 crates/llm-access/src/moderation.rs            | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/crates/llm-access-core/src/moderation.rs b/crates/llm-access-core/src/moderation.rs
index dfd42186..48802a15 100644
--- a/crates/llm-access-core/src/moderation.rs
+++ b/crates/llm-access-core/src/moderation.rs
@@ -185,8 +185,8 @@ impl ModerationMatcher {
     /// distinct, unsuppressed keyword that happens to start at the same
     /// offset as a suppressed one — a content-policy bypass. Filtering by
     /// hit identity via `accept` avoids that; `find_overlapping_iter`
-    /// reports the shorter match at a shared start first, so `accept` sees
-    /// each candidate.
+    /// exposes every candidate at a shared start, so `accept` can inspect each
+    /// one without relying on match order.
     pub fn find_accepted(
         &self,
         normalized_text: &str,
diff --git a/crates/llm-access-core/src/store/moderation.rs b/crates/llm-access-core/src/store/moderation.rs
index 9367b188..8fa90faa 100644
--- a/crates/llm-access-core/src/store/moderation.rs
+++ b/crates/llm-access-core/src/store/moderation.rs
@@ -122,8 +122,8 @@ pub struct ModerationBannedSession {
     pub match_start: i64,
     /// Byte offset just after the hit in normalized request text.
     pub match_end: i64,
-    /// SHA-256 of normalized text before `match_start`, used to validate
-    /// resumable scans.
+    /// SHA-256 of normalized text before `match_start`, used to bind hit
+    /// suppression to the exact reviewed preceding content.
     pub match_prefix_sha256: String,
     /// Hash of the keyword set active when this hit was recorded.
     pub keyword_set_hash: String,
@@ -199,8 +199,8 @@ pub struct NewModerationBannedSession {
     pub banned_at_ms: i64,
 }
 
-/// One reviewed false-positive hit used by the runtime gate to skip repeat
-/// matches and resume near the last reviewed position.
+/// One reviewed false-positive hit used by the runtime gate to suppress only
+/// that exact repeat match.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct ModerationSuppressedHit {
     /// Runtime ban key: `provider:key_id:session_id`.
diff --git a/crates/llm-access/src/moderation.rs b/crates/llm-access/src/moderation.rs
index 4cb373da..8a8e0e43 100644
--- a/crates/llm-access/src/moderation.rs
+++ b/crates/llm-access/src/moderation.rs
@@ -878,7 +878,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn unbanned_hit_resumes_scan_and_blocks_later_hit_in_same_session() {
+    async fn unbanned_hit_is_suppressed_and_later_hit_in_same_session_blocks() {
         let keywords =
             vec![moderation_keyword(1, "build a bomb"), moderation_keyword(2, "carding tutorial")];
         let keyword_set_hash = moderation_keyword_set_hash(&keywords);