Staff Review Workflow

The difference between an anticheat your community trusts and one they rage about isn't detection quality — it's whether punishments can be explained. Review-first moderation means a human looks at the case before the heaviest consequences land, and every decision leaves a trail.

Three queues, three speeds

Route incidents by decision cost, not by check type:

• Auto-contained — policy already acted (blocked event, deleted entities). Staff skim this queue for false containment, not to approve each item. Daily read is enough.
• Needs review — the incident suggests a player did something serious (economy abuse, repeated impossible state). One staff member reviews, decides, records. Target: same day.
• Second opinion — bans and anything touching a known community member. Two staff must agree. This is deliberately slow; it's the queue that protects you from your own bad days.

A decision standard staff can actually apply

For each case ask, in order:

1. Is the evidence about the player or about the server? Restart artifacts, resource bugs, and sync weirdness produce incidents too. If the same signature hits multiple unrelated players at once, suspect the server first.
2. Could a legitimate client plausibly do this? "Improbable" punishes your best and unluckiest players; reserve action for impossible or policy-breaking, and let repeated improbability accumulate into a case instead.
3. Does the timeline tell one story? A real cheater's incident history converges: sequence violations, then payload anomalies, then entity abuse. A false positive stays a lone data point.

If the answer pattern is unclear, the decision is "watch", not "ban". Cases stay open; evidence accumulates.

Record every decision

One line per decision, visible to the whole staff team:

case FIV-042 · player #113 · decision: 7-day ban
evidence: bank:withdraw sequence violation x4 + rate anomaly
reviewed by: Mara, JD · appeal: open

This habit is what makes appeals fast, staff consistent, and "why was I banned?" answerable in one paste.

Appeals are part of the system

Publish where appeals go (a form, a Discord channel, a ticket at /fivem/support), commit to a response window, and have a different staff member review than the one who decided. Overturned decisions are not failures — they're the mechanism that keeps the policy honest. Track the overturn rate: if it climbs above roughly one in ten, your containment rules are too aggressive.

Culture, stated plainly

Tell your community how moderation works: server-side signals, human review, explainable decisions, working appeals. Communities forgive a cheater who slipped through for a week; they don't forgive a regular banned by a black box. Review-first is slower per case and dramatically cheaper per month.