Platform owners and admins can use **Payments** to reconcile course orders and AI
usage. Its section navigation separates the overview, customer orders, AI balance and usage,
and Stripe provider events so unrelated controls are not shown in one long page.

## Payments during early access

Registration and commercial activation are separate decisions. New checkout, seller
onboarding, transfers, payouts and personal top-ups remain closed until their
respective approvals and readiness checks pass, whether registration is public or
invitation-only. Eligible accounts can acquire approved free courses;
the Platform owner may grant documented learner or Instructor testing balance without
a payment. Existing and test-mode orders and payment records remain available for
reconciliation.

IE, ES, US and AU each need reviewed commercial approval for the exact
operator and policy versions before paid courses open in that market. UK commerce
remains closed. A pending Australian seller route does not revoke existing-market approvals. People aged 16–17 need an
active guardian authorisation specifically for purchasing and cannot author, sell
or hold finance/organisation-administrator permissions. Top-ups remain separately
gated even after course-commerce approval.

When public registration is enabled, eligible people in the supported countries can
create a personal account without a beta invitation. Under the invitation-only staged
policy, protected access requires a current personal invitation, including for existing
accounts. Both policies retain age, residence and capability checks. Payments,
assignments and audited credit adjustments do not create an account or bypass admission,
suspension, membership or entitlement checks. Reconcile orders, confirmations, refunds
and failures using the usual operations below.

## Review operations

Open **Platform Admin → Payments** to review:

- recent personal course, Organisation seat, and personal top-up orders;
- completed and pending totals;
- failed Stripe webhook events;
- open reservations against the euro AI balance; and
- recent payment-event identifiers for provider reconciliation.

Use **Overview** for status totals, **Orders** for purchase records and order review,
**AI balance and usage** for usage pricing and support adjustments, and **Provider events**
for Stripe webhook delivery.

## Run course campaigns

Open **Platform Admin → Campaigns** to create a public sale or coupon. Campaigns use
5% discount increments, last no more than 31 days and can target all eligible courses
or an explicit selection. Optional market, currency, learner-account and redemption
limits narrow eligibility. Review included and excluded courses and the price and
earnings impact before activation. Deactivation requires a reason and remains in the
audit history. Coupon codes stay masked in normal administration views.

## Configure AI balance and usage in euros

**AI balance and usage → Rates and limits** is the operational source of truth for new AI
requests. The first release uses euro-denominated balances. It controls:

- the reviewed USD-to-EUR exchange rate and usage-price multiplier;
- the monthly Instructor workspace balance, used by AI interactions in **Test**
  mode and the workspace assistant;
- exact provider model and search prices;
- the maximum size and cleanup timeout of a request reservation; and
- provider-cost estimates used in the Platform Admin report.

If euro balance settings are not configured in an environment, rate, top-up and account
adjustment controls remain unavailable.

Enter a reason before saving. Each change receives a new rate version and is written
to the Platform audit log. Edge functions refresh these settings within about one
minute. Environment values remain fail-safe defaults if the settings table is
temporarily unavailable.

The save is protected against another administrator changing the rates while your
form is open. If the active version changed, refresh the page, compare the latest
values, and submit the change again rather than overwriting the newer decision.

The AI balance bundled with a paid course is not global. Configure that value
inside the course workspace under **Settings → Commerce**. Each Organisation assignment
still receives its own balance; it does not draw from a shared organization pot.

Use Stripe Dashboard for payment-method, receipt, dispute, and refund operations.
Never grant purchased access from a pending Checkout Session.

## Create an AI balance adjustment

Only the Platform owner can grant manual AI funding. Delegated admins can continue
their usual account administration, but must ask the owner for a documented
AI balance adjustment. This restriction applies in both Accounts and Payments.

1. Find the account under **Platform Admin → Accounts**. Select **Adjust AI balance**
   to open the focused account adjustment. The dialog keeps the person's name, email,
   and account state visible; global pricing and payment controls remain in
   **Platform Admin → Payments**. Use **Copy ID** only when recording the support case
   elsewhere.
2. Choose **Personal shared** or **Instructor workspace**.
3. Enter a positive amount in the unit shown by the active balance model and a
   specific reason.
4. Select **Create adjustment**.

The adjustment creates a new immutable grant and a Platform audit event. It does not
rewrite prior usage. Negative adjustments and course-specific support grants are not
enabled in this first release. Personal top-ups require separate commercial approval;
use an adjustment only for documented testing, a correction or a support case.

If the response is interrupted after you select **Create adjustment**, keep the same
values and try again. The page reuses the pending request identifier so an uncertain
response cannot create a second grant. Changing the user, amount, scope, or reason
starts a new adjustment request.

The balance grant or rate change and its Platform audit event are one transaction: neither is
kept when the other cannot be recorded. If a response is interrupted, retry the same
unchanged request from the page. The retained request identifier confirms the existing
result without duplicating it; reusing that identifier with different values is
rejected.

## Reconcile unusual activity

Compare the payment order, webhook event, access record, grant, and usage reservation.
Escalate a completed payment with no matching access, a failed webhook, or a
reservation that remains open beyond the configured cleanup window.

Read [Review a purchase refund](/help/administration/review-purchase-refunds) for
the supported order-review and refund workflow.

## Keep AI balance separate from payments

The monthly Instructor workspace balance funds previews and assistant activity.
It does not change the balance included with a learner licence. An AI balance adjustment
records a monetary usage budget for AI; it does not initiate a card payment or a bank
transfer. Keep payment reconciliation and AI-credit support records distinct.

Platform owners and admins can use Payments to reconcile course orders and AI usage. Its section navigation separates the overview, customer orders, AI balance and usage, and Stripe provider events so unrelated controls are not shown in one long page. Payments during early access Registration and commercial activation are separate decisions. New checkout, seller onboarding, transfers, payouts and personal top ups remain closed until their respective approvals and readiness checks pass, whether registration is public or invitation only. Eligible accounts can acquire approved free courses; the Platform owner may grant documented learner or Instructor testing balance without a payment. Existing and test mode orders and payment records remain available for reconciliation. IE, ES, US and AU each need reviewed commercial approval for the exact operator and policy versions before paid courses open in that market. UK commerce remains closed. A pending Australian seller route does not revoke existing market approvals. People aged 16–17 need an active guardian authorisation specifically for purchasing and cannot author, sell or hold finance/organisation administrator permissions. Top ups remain separately gated even after course commerce approval. When public registration is enabled, eligible people in the supported countries can create a personal account without a beta invitation. Under the invitation only staged policy, protected access requires a current personal invitation, including for existing accounts. Both policies retain age, residence and capability checks. Payments, assignments and audited credit adjustments do not create an account or bypass admission, suspension, membership or entitlement checks. Reconcile orders, confirmations, refunds and failures using the usual operations below. Review operations Open Platform Admin → Payments to review: recent personal course, Organisation seat, and personal top up orders; completed and pending totals; failed Stripe webhook events; open reservations against the euro AI balance; and recent payment event identifiers for provider reconciliation. Use Overview for status totals, Orders for purchase records and order review, AI balance and usage for usage pricing and support adjustments, and Provider events for Stripe webhook delivery. Run course campaigns Open Platform Admin → Campaigns to create a public sale or coupon. Campaigns use 5% discount increments, last no more than 31 days and can target all eligible courses or an explicit selection. Optional market, currency, learner account and redemption limits narrow eligibility. Review included and excluded courses and the price and earnings impact before activation. Deactivation requires a reason and remains in the audit history. Coupon codes stay masked in normal administration views. Configure AI balance and usage in euros AI balance and usage → Rates and limits is the operational source of truth for new AI requests. The first release uses euro denominated balances. It controls: the reviewed USD to EUR exchange rate and usage price multiplier; the monthly Instructor workspace balance, used by AI interactions in Test mode and the workspace assistant; exact provider model and search prices; the maximum size and cleanup timeout of a request reservation; and provider cost estimates used in the Platform Admin report. If euro balance settings are not configured in an environment, rate, top up and account adjustment controls remain unavailable. Enter a reason before saving. Each change receives a new rate version and is written to the Platform audit log. Edge functions refresh these settings within about one minute. Environment values remain fail safe defaults if the settings table is temporarily unavailable. The save is protected against another administrator changing the rates while your form is open. If the active version changed, refresh the page, compare the latest values, and submit the change again rather than overwriting the newer decision. The AI balance bundled with a paid course is not global. Configure that value inside the course workspace under Settings → Commerce . Each Organisation assignment still receives its own balance; it does not draw from a shared organization pot. Use Stripe Dashboard for payment method, receipt, dispute, and refund operations. Never grant purchased access from a pending Checkout Session. Create an AI balance adjustment Only the Platform owner can grant manual AI funding. Delegated admins can continue their usual account administration, but must ask the owner for a documented AI balance adjustment. This restriction applies in both Accounts and Payments. 1. Find the account under Platform Admin → Accounts . Select Adjust AI balance to open the focused account adjustment. The dialog keeps the person's name, email, and account state visible; global pricing and payment controls remain in Platform Admin → Payments . Use Copy ID only when recording the support case elsewhere. 2. Choose Personal shared or Instructor workspace . 3. Enter a positive amount in the unit shown by the active balance model and a specific reason. 4. Select Create adjustment . The adjustment creates a new immutable grant and a Platform audit event. It does not rewrite prior usage. Negative adjustments and course specific support grants are not enabled in this first release. Personal top ups require separate commercial approval; use an adjustment only for documented testing, a correction or a support case. If the response is interrupted after you select Create adjustment , keep the same values and try again. The page reuses the pending request identifier so an uncertain response cannot create a second grant. Changing the user, amount, scope, or reason starts a new adjustment request. The balance grant or rate change and its Platform audit event are one transaction: neither is kept when the other cannot be recorded. If a response is interrupted, retry the same unchanged request from the page. The retained request identifier confirms the existing result without duplicating it; reusing that identifier with different values is rejected. Reconcile unusual activity Compare the payment order, webhook event, access record, grant, and usage reservation. Escalate a completed payment with no matching access, a failed webhook, or a reservation that remains open beyond the configured cleanup window. Read Review a purchase refund for the supported order review and refund workflow. Keep AI balance separate from payments The monthly Instructor workspace balance funds previews and assistant activity. It does not change the balance included with a learner licence. An AI balance adjustment records a monetary usage budget for AI; it does not initiate a card payment or a bank transfer. Keep payment reconciliation and AI credit support records distinct.

Review Stripe orders, monetary AI balances, confirmed usage, provider events, and reasoned support adjustments.

Manage course payments, AI balance and usage

## Review a refund request

Open **Platform → Purchases and cancellations** from the sidebar or the cancellation card on the dashboard. Each open request shows the product as purchased, the verified amount paid, the purchase date and a usage summary. Only Platform owners and admins can access this review.

The summary shows AI balance used in euros, course runs started and completed, current stage completion where recorded, and the last recorded visit. Course history may predate the purchase. Current progress refers to the learner's active course version, not the latest catalogue version. A missing record is not proof that the course was unused.

The AI amount covers only balance funded by that purchase. Shared personal balance can be used in other eligible courses, so it is not necessarily the AI cost of this course alone. These are live totals when refreshed, not a frozen record from when cancellation was requested. Time spent and learner submissions are not shown.

For accepted policies and more order detail, use **Platform → Payments → Review a purchase**, entering the order reference from the request or selecting a recent order. Existing orders retain their original terms.

Completion or AI use alone does not automatically reject an individual course request. Process approved refunds through the existing Stripe workflow. Full refunds revoke the applicable access and all unused balance after the signed payment update is processed. Partial refunds reduce AI funding proportionally to the original purchase allocation, using the cumulative refunded amount. They do not automatically revoke access or seats; support must reconcile those separately. Confirmed AI usage and its provider cost remain recorded.

Review a refund request Open Platform → Purchases and cancellations from the sidebar or the cancellation card on the dashboard. Each open request shows the product as purchased, the verified amount paid, the purchase date and a usage summary. Only Platform owners and admins can access this review. The summary shows AI balance used in euros, course runs started and completed, current stage completion where recorded, and the last recorded visit. Course history may predate the purchase. Current progress refers to the learner's active course version, not the latest catalogue version. A missing record is not proof that the course was unused. The AI amount covers only balance funded by that purchase. Shared personal balance can be used in other eligible courses, so it is not necessarily the AI cost of this course alone. These are live totals when refreshed, not a frozen record from when cancellation was requested. Time spent and learner submissions are not shown. For accepted policies and more order detail, use Platform → Payments → Review a purchase , entering the order reference from the request or selecting a recent order. Existing orders retain their original terms. Completion or AI use alone does not automatically reject an individual course request. Process approved refunds through the existing Stripe workflow. Full refunds revoke the applicable access and all unused balance after the signed payment update is processed. Partial refunds reduce AI funding proportionally to the original purchase allocation, using the cumulative refunded amount. They do not automatically revoke access or seats; support must reconcile those separately. Confirmed AI usage and its provider cost remain recorded.

Find an exact order and review its accepted policies, AI balance usage and learning history.

Review a purchase refund

Moderation cases give authorised Discentik administrators one internal record for an
account or course investigation. Authenticated reports automatically open a linked
case. A failed automated course-submission safety check also opens one high-priority
case, while repeat failures reuse the active case. The timeline preserves reports, assignment changes, evidence references,
appeals, priority changes, and the final decision.

The queue opens on active cases ordered by the nearest SLA deadline. Filter it by
status, assignment, priority, subject, category, or overdue state, and use **Load more
cases** to continue through the result set. Closed cases remain available under **All
cases**. The queue stays usable if either the separate summary metrics or analytics
request is temporarily unavailable; retry the affected summary without reloading the
queue.

The summary cards show active, overdue, unassigned, and appealed cases. They also show
24-hour report intake and recent resolution performance. An SLA becomes due after 4
hours for urgent cases, 24 hours for high-priority cases, 72 hours for normal cases,
and 168 hours for low-priority cases. Claiming a case records its first response.
The trend section summarises the last 30 days and exports daily opened, resolved,
report, and appeal counts as CSV. Assigned administrators receive a due-soon alert;
overdue unassigned cases alert Platform Admins. Alerts are deduplicated per case and
deadline stage.

## Open a case

1. Open **Discentik Admin**, then **Moderation**.
2. Select **Open case**.
3. Choose **Account** or **Course** and enter the account email/profile ID or course ID.
4. Select the category, source, and priority.
5. Add a concise summary and the available report context, then select **Open case**.

Do not paste passwords, payment-card details, or unrelated personal data into case notes.

## Investigate and assign ownership

Select **Review** beside a case, then select **Claim case** before investigating it.
Use **Release case** when another administrator should take over. Add internal notes for
verified checks and investigation context. Do not link to material that the moderation
team is not authorised to access. Notes and evidence are not sent to the reported
person or course author.

The selected case is organised into five sections so its investigation record stays
compact:

- **Overview** contains ownership, priority, status decisions, linked reports, and the
  shortcut to the affected account or course.
- **Enforcement** contains live restrictions and their reversal controls.
- **Internal timeline** contains the chronological audit trail and the internal-note
  composer. Select **Add internal note** only when you need to record a new entry.
- **Evidence references** contains structured references and private image evidence.
- **Appeals** contains appeal intake, review, and decisions.

The number beside Timeline, Evidence, or Appeals shows how many records are currently
loaded. Use the section bar to move between tasks without losing an unfinished entry.
On a keyboard, focus a section and use the Left or Right arrow keys, Home, or End to
move between sections. The complete case context is collapsed beneath the case heading;
expand **Case context** when those details are needed.

For new user reports, expand **Captured content and references** in the evidence
area. Course reports include the approved presentation and exact release reference;
reports made during learning use that learner's release. Profile, review, and
message reports preserve the selected content at submission. Message evidence contains
only the selected message and thread reference, not the whole conversation. Treat
this evidence separately from current account or course details, which may have changed.

Long-running cases initially load a bounded page from each history area. When more
timeline events, reports, evidence, appeals, or enforcement records exist, select
**Load more case history** to retrieve the next page from every incomplete area. The
panel shows how many history records are loaded and keeps the action available for any
area that could not be retrieved, so you can retry without losing the pages that did
load.

Use **Evidence references** only for HTTPS sources or clearly labelled administrator
statements. Use **Private evidence image** for a screenshot that must not be placed at
a public URL. You must own the case before adding either kind of evidence. Only JPEG,
PNG, and WebP images up to 5 MB are accepted. The upload is checked against its declared
file type, screened for known unsafe file patterns, and sent through automated image
moderation by OpenAI before it is stored. A failed or unavailable moderation step
rejects the upload. Upload only evidence that Discentik is authorised to share with
this processor and avoid unnecessary personal data. See the [Privacy Policy](/privacy)
for processing details.

Accepted files remain in private storage and open through a five-minute,
administrator-only link. Every signed-link request is audited. The scheduled retention
process removes a file after 90 days only when the case has no active investigation,
appeal, enforcement, or legal hold. Its audit metadata remains after the private file is
removed. Prefer a text statement when an image is not necessary.

### Preserve a private image under legal hold

Use a legal hold only when an authorised legal, regulatory, or investigation request
requires the private image to remain beyond its normal retention period. You must own
the case, and the file must still be available.

1. Under the private evidence image, enter a future **Legal hold end** no more than ten
   years away.
2. Enter a clear reason that identifies the preservation need without adding unrelated
   personal information.
3. Select **Apply legal hold**. For an existing hold, choose a later date and select
   **Extend legal hold**.

The evidence card shows the recorded end and reason. Applying, extending, and releasing
a hold creates a case-timeline entry and Platform audit record. When preservation is no
longer required, enter the release reason and select **Release legal hold**. The normal
retention rules then apply again. Confirm the named evidence and its current hold end in
the warning dialog. Releasing a hold does not immediately delete the file, but scheduled
retention may permanently delete it as soon as it becomes eligible; deletion cannot be
undone. Cancelling or a failed release leaves both the hold and your entered reason in
place. An image that has already been deleted cannot be placed on hold.

## Apply or reverse enforcement

Claim the case before changing live access. In **Enforcement**, enter the policy or
decision reason, then select **Suspend account** or **Withdraw course**. Reopen a
**Resolved** or **Dismissed** case before applying or reversing enforcement. Account suspension
blocks sign-in, Platform API access, and existing trusted AI sessions while preserving
the account and its data. A course withdrawal makes the course private and immediately
blocks learner and runtime access, including access through existing assignments and
library entries. Course content, learner progress, assignments, and the approved
revision remain preserved.

The case stores the exact prior state and adds the action to both the case timeline and
Platform audit history. Select **Restore account access** or **Restore course access**
to reverse the restriction. A reversal also requires a reason. If the account or course
was changed through another workflow after enforcement, the case refuses to overwrite
that newer state; review the dedicated account or course controls first.

An account already suspended outside the case, or a course already emergency-withdrawn
outside the case, cannot be adopted silently as case enforcement. This distinction
keeps the owner and reason for every restriction clear.

## Resolve or dismiss a case

Set the case to **Action required** while an enforcement or follow-up action remains.
Set it to **Resolved** after the required action and verification are complete. Use
**Dismissed** when the report is unsupported or does not violate policy.

Every status decision records an internal note in the timeline. Reopening a closed case
clears its resolution marker while preserving the earlier history.

## Record and decide an appeal

When case-linked enforcement is applied, the affected account or course owner receives
a private, single-use appeal link by email that remains usable even when account sign-in
is suspended. The link expires after 30 days and places its token in the browser
fragment, so it is not sent in the page URL or referrer or stored in the notification
record. If delivery fails, the enforcement still completes with a visible warning;
after correcting email configuration, the case owner can select **Send new appeal
link**. Creating a replacement first revokes every older unused link. If delivery of
the replacement cannot be confirmed, that new link is revoked as well, so correct the
delivery problem and send another link rather than reusing an earlier URL. A submitted
appeal returns the case to **In review** and alerts Platform Admins.
Support can still use **Record an appeal** after a case is **Resolved** or **Dismissed**
when it has separately verified the appellant. The affected account or course owner is
derived from the case and cannot be replaced with an arbitrary recipient.

An administrator who applied the linked enforcement or made the original resolution
cannot decide its appeal. A different case owner must add a decision note, then select
**Grant appeal** or **Deny appeal**.
Granting an appeal moves the case to **Action required**. If the case has an active
restriction, reverse it from **Enforcement** and record the appeal decision as the
reversal reason. Denying an appeal restores the case's earlier closed status. Both
outcomes remain in the case timeline and audit log.
The appellant receives the appeal outcome by in-app notification and email when email
delivery is configured.

### Reconcile a quarantined legacy appeal

An older migrated appeal may be quarantined when its original enforcement link cannot
be determined safely. The case shows **Legacy appeal link requires reconciliation**
and blocks the review decision until that historical link is repaired. Do not choose an
enforcement by assumption.

Only the Platform owner can perform this recovery:

1. Claim the case with the Platform owner account.
2. Review the appeal, case timeline, and every enforcement record. Select **Load more
   case history** first when older enforcement records remain.
3. Under **Appealed enforcement**, choose the active or reversed applied action that
   the appeal actually challenges.
4. Enter a reconciliation reason explaining how the match was verified, then select
   **Reconcile appeal link**.

The recovery is version-checked and adds both a case-timeline entry and a Platform
audit record. It does not grant, deny, apply, or reverse an enforcement. After the link
is repaired, release the case when separation of duties requires a different Platform
Admin to decide the appeal. If the correct applied enforcement is absent or cannot be
verified, stop and escalate the record for data repair rather than linking it.

Preserve a private image under legal hold

Moderation cases give authorised Discentik administrators one internal record for an account or course investigation. Authenticated reports automatically open a linked case. A failed automated course submission safety check also opens one high priority case, while repeat failures reuse the active case. The timeline preserves reports, assignment changes, evidence references, appeals, priority changes, and the final decision. The queue opens on active cases ordered by the nearest SLA deadline. Filter it by status, assignment, priority, subject, category, or overdue state, and use Load more cases to continue through the result set. Closed cases remain available under All cases . The queue stays usable if either the separate summary metrics or analytics request is temporarily unavailable; retry the affected summary without reloading the queue. The summary cards show active, overdue, unassigned, and appealed cases. They also show 24 hour report intake and recent resolution performance. An SLA becomes due after 4 hours for urgent cases, 24 hours for high priority cases, 72 hours for normal cases, and 168 hours for low priority cases. Claiming a case records its first response. The trend section summarises the last 30 days and exports daily opened, resolved, report, and appeal counts as CSV. Assigned administrators receive a due soon alert; overdue unassigned cases alert Platform Admins. Alerts are deduplicated per case and deadline stage. Open a case 1. Open Discentik Admin , then Moderation . 2. Select Open case . 3. Choose Account or Course and enter the account email/profile ID or course ID. 4. Select the category, source, and priority. 5. Add a concise summary and the available report context, then select Open case . Do not paste passwords, payment card details, or unrelated personal data into case notes. Investigate and assign ownership Select Review beside a case, then select Claim case before investigating it. Use Release case when another administrator should take over. Add internal notes for verified checks and investigation context. Do not link to material that the moderation team is not authorised to access. Notes and evidence are not sent to the reported person or course author. The selected case is organised into five sections so its investigation record stays compact: Overview contains ownership, priority, status decisions, linked reports, and the shortcut to the affected account or course. Enforcement contains live restrictions and their reversal controls. Internal timeline contains the chronological audit trail and the internal note composer. Select Add internal note only when you need to record a new entry. Evidence references contains structured references and private image evidence. Appeals contains appeal intake, review, and decisions. The number beside Timeline, Evidence, or Appeals shows how many records are currently loaded. Use the section bar to move between tasks without losing an unfinished entry. On a keyboard, focus a section and use the Left or Right arrow keys, Home, or End to move between sections. The complete case context is collapsed beneath the case heading; expand Case context when those details are needed. For new user reports, expand Captured content and references in the evidence area. Course reports include the approved presentation and exact release reference; reports made during learning use that learner's release. Profile, review, and message reports preserve the selected content at submission. Message evidence contains only the selected message and thread reference, not the whole conversation. Treat this evidence separately from current account or course details, which may have changed. Long running cases initially load a bounded page from each history area. When more timeline events, reports, evidence, appeals, or enforcement records exist, select Load more case history to retrieve the next page from every incomplete area. The panel shows how many history records are loaded and keeps the action available for any area that could not be retrieved, so you can retry without losing the pages that did load. Use Evidence references only for HTTPS sources or clearly labelled administrator statements. Use Private evidence image for a screenshot that must not be placed at a public URL. You must own the case before adding either kind of evidence. Only JPEG, PNG, and WebP images up to 5 MB are accepted. The upload is checked against its declared file type, screened for known unsafe file patterns, and sent through automated image moderation by OpenAI before it is stored. A failed or unavailable moderation step rejects the upload. Upload only evidence that Discentik is authorised to share with this processor and avoid unnecessary personal data. See the Privacy Policy for processing details. Accepted files remain in private storage and open through a five minute, administrator only link. Every signed link request is audited. The scheduled retention process removes a file after 90 days only when the case has no active investigation, appeal, enforcement, or legal hold. Its audit metadata remains after the private file is removed. Prefer a text statement when an image is not necessary. Preserve a private image under legal hold Use a legal hold only when an authorised legal, regulatory, or investigation request requires the private image to remain beyond its normal retention period. You must own the case, and the file must still be available. 1. Under the private evidence image, enter a future Legal hold end no more than ten years away. 2. Enter a clear reason that identifies the preservation need without adding unrelated personal information. 3. Select Apply legal hold . For an existing hold, choose a later date and select Extend legal hold . The evidence card shows the recorded end and reason. Applying, extending, and releasing a hold creates a case timeline entry and Platform audit record. When preservation is no longer required, enter the release reason and select Release legal hold . The normal retention rules then apply again. Confirm the named evidence and its current hold end in the warning dialog. Releasing a hold does not immediately delete the file, but scheduled retention may permanently delete it as soon as it becomes eligible; deletion cannot be undone. Cancelling or a failed release leaves both the hold and your entered reason in place. An image that has already been deleted cannot be placed on hold. Apply or reverse enforcement Claim the case before changing live access. In Enforcement , enter the policy or decision reason, then select Suspend account or Withdraw course . Reopen a Resolved or Dismissed case before applying or reversing enforcement. Account suspension blocks sign in, Platform API access, and existing trusted AI sessions while preserving the account and its data. A course withdrawal makes the course private and immediately blocks learner and runtime access, including access through existing assignments and library entries. Course content, learner progress, assignments, and the approved revision remain preserved. The case stores the exact prior state and adds the action to both the case timeline and Platform audit history. Select Restore account access or Restore course access to reverse the restriction. A reversal also requires a reason. If the account or course was changed through another workflow after enforcement, the case refuses to overwrite that newer state; review the dedicated account or course controls first. An account already suspended outside the case, or a course already emergency withdrawn outside the case, cannot be adopted silently as case enforcement. This distinction keeps the owner and reason for every restriction clear. Resolve or dismiss a case Set the case to Action required while an enforcement or follow up action remains. Set it to Resolved after the required action and verification are complete. Use Dismissed when the report is unsupported or does not violate policy. Every status decision records an internal note in the timeline. Reopening a closed case clears its resolution marker while preserving the earlier history. Record and decide an appeal When case linked enforcement is applied, the affected account or course owner receives a private, single use appeal link by email that remains usable even when account sign in is suspended. The link expires after 30 days and places its token in the browser fragment, so it is not sent in the page URL or referrer or stored in the notification record. If delivery fails, the enforcement still completes with a visible warning; after correcting email configuration, the case owner can select Send new appeal link . Creating a replacement first revokes every older unused link. If delivery of the replacement cannot be confirmed, that new link is revoked as well, so correct the delivery problem and send another link rather than reusing an earlier URL. A submitted appeal returns the case to In review and alerts Platform Admins. Support can still use Record an appeal after a case is Resolved or Dismissed when it has separately verified the appellant. The affected account or course owner is derived from the case and cannot be replaced with an arbitrary recipient. An administrator who applied the linked enforcement or made the original resolution cannot decide its appeal. A different case owner must add a decision note, then select Grant appeal or Deny appeal . Granting an appeal moves the case to Action required . If the case has an active restriction, reverse it from Enforcement and record the appeal decision as the reversal reason. Denying an appeal restores the case's earlier closed status. Both outcomes remain in the case timeline and audit log. The appellant receives the appeal outcome by in app notification and email when email delivery is configured. Reconcile a quarantined legacy appeal An older migrated appeal may be quarantined when its original enforcement link cannot be determined safely. The case shows Legacy appeal link requires reconciliation and blocks the review decision until that historical link is repaired. Do not choose an enforcement by assumption. Only the Platform owner can perform this recovery: 1. Claim the case with the Platform owner account. 2. Review the appeal, case timeline, and every enforcement record. Select Load more case history first when older enforcement records remain. 3. Under Appealed enforcement , choose the active or reversed applied action that the appeal actually challenges. 4. Enter a reconciliation reason explaining how the match was verified, then select Reconcile appeal link . The recovery is version checked and adds both a case timeline entry and a Platform audit record. It does not grant, deny, apply, or reverse an enforcement. After the link is repaired, release the case when separation of duties requires a different Platform Admin to decide the appeal. If the correct applied enforcement is absent or cannot be verified, stop and escalate the record for data repair rather than linking it.

Open, assign, document, and resolve an account or course moderation investigation.

Investigate a moderation case

Platform account management lets authorised Discentik administrators stop an account
from signing in without deleting the account or its data. Every suspension and
reactivation requires a reason and is added to the Platform audit history.

## Account state and early access

Active accounts can use Discentik during early access without a separate invitation
grant. Public self-sign-up is the only restriction controlled by early access.
Reactivating an account restores its normal eligibility, subject to its organisation
membership, roles and course entitlements.

Cancelling an early-access invitation prevents that link from completing onboarding;
it does not suspend an existing account or remove its ordinary product access. Use
**Accounts** to suspend an account when access must stop. An invitation never overrides
a suspension or an organisation-level deactivation.

## Find an account

1. Open **Discentik Admin**, then **Accounts**.
2. Search by the person's name or email address.
3. Filter by account state or role when you need to narrow the results.
4. Check the organisation state, recent sign-in, identity provider, and previous
   account-action count before making a change.

## Adjust an account's AI balance

Select **Adjust AI balance** beside the account. The compact dialog keeps the selected
person's name, email address, and account state visible while you work; it does not
show or change global payment, pricing, or AI-rate settings.

Choose the personal or Instructor workspace, enter the positive amount to add, and
record the approved support or refill reason. The amount follows the active balance
model shown in the dialog. Select **Create adjustment** to create an immutable grant
and Platform audit event for that account. Close the dialog to return to the unchanged
account list. Platform team identities do not use personal or Instructor AI balance,
so this action is unavailable for those accounts.

## Suspend global access

1. Select **Suspend** beside the account.
2. Enter a specific reason that another administrator can understand later.
3. Select **Suspend account**.

Suspension blocks new sign-ins, Platform API access, AI requests, and the creation of
new AI access tokens while preserving the account, course activity, and organisation
records. Existing trusted AI sessions recheck the account before every request, so a
suspended account cannot continue using an earlier token. You cannot suspend your own
account or the Platform owner from this workspace. Only the Platform owner can change
another Platform team member's global access.

## Restore global access

1. Find the suspended account and select **Reactivate**.
2. Enter the outcome of your review or the reason access can be restored.
3. Select **Reactivate account**.

Global reactivation does not override an organisation-level deactivation. If the
account is still marked **Organisation deactivated**, an authorised organisation
administrator must restore that membership separately before the person can sign in.

Platform account management lets authorised Discentik administrators stop an account from signing in without deleting the account or its data. Every suspension and reactivation requires a reason and is added to the Platform audit history. Account state and early access Active accounts can use Discentik during early access without a separate invitation grant. Public self sign up is the only restriction controlled by early access. Reactivating an account restores its normal eligibility, subject to its organisation membership, roles and course entitlements. Cancelling an early access invitation prevents that link from completing onboarding; it does not suspend an existing account or remove its ordinary product access. Use Accounts to suspend an account when access must stop. An invitation never overrides a suspension or an organisation level deactivation. Find an account 1. Open Discentik Admin , then Accounts . 2. Search by the person's name or email address. 3. Filter by account state or role when you need to narrow the results. 4. Check the organisation state, recent sign in, identity provider, and previous account action count before making a change. Adjust an account's AI balance Select Adjust AI balance beside the account. The compact dialog keeps the selected person's name, email address, and account state visible while you work; it does not show or change global payment, pricing, or AI rate settings. Choose the personal or Instructor workspace, enter the positive amount to add, and record the approved support or refill reason. The amount follows the active balance model shown in the dialog. Select Create adjustment to create an immutable grant and Platform audit event for that account. Close the dialog to return to the unchanged account list. Platform team identities do not use personal or Instructor AI balance, so this action is unavailable for those accounts. Suspend global access 1. Select Suspend beside the account. 2. Enter a specific reason that another administrator can understand later. 3. Select Suspend account . Suspension blocks new sign ins, Platform API access, AI requests, and the creation of new AI access tokens while preserving the account, course activity, and organisation records. Existing trusted AI sessions recheck the account before every request, so a suspended account cannot continue using an earlier token. You cannot suspend your own account or the Platform owner from this workspace. Only the Platform owner can change another Platform team member's global access. Restore global access 1. Find the suspended account and select Reactivate . 2. Enter the outcome of your review or the reason access can be restored. 3. Select Reactivate account . Global reactivation does not override an organisation level deactivation. If the account is still marked Organisation deactivated , an authorised organisation administrator must restore that membership separately before the person can sign in.

Find an account, adjust its AI balance, block global access, or restore it after review.

Suspend or restore a Discentik account

Authorised Platform owners can invite another Discentik administrator to the Platform
team. Each link is valid for seven days, works once, and grants only the Platform role
selected when it was created.

Platform identities have a deliberately limited **Profile** screen: account identity,
interface language, security and personal privacy controls. They do not receive
learning, course-authoring, purchase, public-profile, organisation-workspace or
personal AI-balance settings. Use a separate personal account for those activities;
never add learner or Instructor entitlements to a Platform identity.

## Create an invitation

1. Open **Discentik Admin**, then **Team**.
2. Select **Invite**.
3. Enter the teammate's email address and choose the required Platform role.
4. Select **Create invite**, then share the generated link only with that person.

The address must not already belong to a Discentik account. If an earlier pending link
for the same address expired, creating a new invitation replaces that expired pending
record. Creating the invitation and its Platform audit event is one transaction. If
the response is interrupted, retry the unchanged invitation from the page; its request
identifier prevents a second token from being created.

## Accept an invitation

1. Open the invitation and enter your name.
2. Select **Send secure verification link**. A password is not created and the
   invitation is not consumed at this stage.
3. Open the secure link sent to the invited email address.
4. On the returned invitation page, create a new password and select **Set password
   and accept invitation**.

The returned email session, one-time link, invited email, created account, and
database-assigned Platform role are checked together. Other sessions for that account
are revoked before access is granted, then the profile, invitation consumption, and
audit record are committed together. A normal password sign-in cannot substitute for
the secure email link.

An expired or previously accepted link cannot be reused. Create a new invitation when
the seven-day window has passed. Do not change the email in an old link or forward a
link to a different person.

## Cancel pending access

Open the pending invitations list from **Team** and cancel a link that was sent to the
wrong address or is no longer needed. Expired links disappear from the pending list;
they do not resolve to Platform team profiles later. Cancellation checks the exact
invitation version and commits with its audit event, so refresh before retrying a
version-conflict message.

## Remove teammate access

Use **Remove** beside a teammate only after confirming the person and current Platform
role. The workflow changes the account back to an ordinary user, revokes its active
sessions, and records the removal in the Platform audit log as one transaction. It
does not delete the person's ordinary learning account or history.

You cannot remove yourself or the Platform owner through this control. Refresh before
retrying when the teammate's role changed in another session.

## Transfer Platform ownership

Only the current Platform owner can transfer ownership, and the recipient must be an
active **Platform admin** on the same Platform team.

1. Open **Discentik Admin**, then **Team**.
2. Select **Transfer ownership** beside the new owner.
3. Confirm **Send code**. The code is sent to the current owner's verified email and
   expires after ten minutes.
4. Enter the six-digit code and select **Verify transfer**.

The database rechecks both accounts, promotes the selected teammate, moves every
Platform teammate and pending invitation to the new owner, keeps the previous owner
as a Platform admin, revokes both owners' sessions, and records the audit event in one
transaction. If delivery fails, the pending challenge is cancelled. If the response
is interrupted after verification, retry the same code from the open form; the same
operation cannot apply the transfer twice.

## Delete a Platform identity

Platform owners and teammates cannot use ordinary self-service account deletion while
they still hold Platform access. Remove a teammate through the audited workflow first;
they can then use the ordinary deletion flow as a user. Platform-owner deletion stays
blocked until ownership has been transferred through **Discentik Admin** > **Team**.
After transfer, another Platform owner must remove the former owner's Platform access
before ordinary account deletion becomes available. Do not use direct database or Auth
deletion as a substitute.

Authorised Platform owners can invite another Discentik administrator to the Platform team. Each link is valid for seven days, works once, and grants only the Platform role selected when it was created. Platform identities have a deliberately limited Profile screen: account identity, interface language, security and personal privacy controls. They do not receive learning, course authoring, purchase, public profile, organisation workspace or personal AI balance settings. Use a separate personal account for those activities; never add learner or Instructor entitlements to a Platform identity. Create an invitation 1. Open Discentik Admin , then Team . 2. Select Invite . 3. Enter the teammate's email address and choose the required Platform role. 4. Select Create invite , then share the generated link only with that person. The address must not already belong to a Discentik account. If an earlier pending link for the same address expired, creating a new invitation replaces that expired pending record. Creating the invitation and its Platform audit event is one transaction. If the response is interrupted, retry the unchanged invitation from the page; its request identifier prevents a second token from being created. Accept an invitation 1. Open the invitation and enter your name. 2. Select Send secure verification link . A password is not created and the invitation is not consumed at this stage. 3. Open the secure link sent to the invited email address. 4. On the returned invitation page, create a new password and select Set password and accept invitation . The returned email session, one time link, invited email, created account, and database assigned Platform role are checked together. Other sessions for that account are revoked before access is granted, then the profile, invitation consumption, and audit record are committed together. A normal password sign in cannot substitute for the secure email link. An expired or previously accepted link cannot be reused. Create a new invitation when the seven day window has passed. Do not change the email in an old link or forward a link to a different person. Cancel pending access Open the pending invitations list from Team and cancel a link that was sent to the wrong address or is no longer needed. Expired links disappear from the pending list; they do not resolve to Platform team profiles later. Cancellation checks the exact invitation version and commits with its audit event, so refresh before retrying a version conflict message. Remove teammate access Use Remove beside a teammate only after confirming the person and current Platform role. The workflow changes the account back to an ordinary user, revokes its active sessions, and records the removal in the Platform audit log as one transaction. It does not delete the person's ordinary learning account or history. You cannot remove yourself or the Platform owner through this control. Refresh before retrying when the teammate's role changed in another session. Transfer Platform ownership Only the current Platform owner can transfer ownership, and the recipient must be an active Platform admin on the same Platform team. 1. Open Discentik Admin , then Team . 2. Select Transfer ownership beside the new owner. 3. Confirm Send code . The code is sent to the current owner's verified email and expires after ten minutes. 4. Enter the six digit code and select Verify transfer . The database rechecks both accounts, promotes the selected teammate, moves every Platform teammate and pending invitation to the new owner, keeps the previous owner as a Platform admin, revokes both owners' sessions, and records the audit event in one transaction. If delivery fails, the pending challenge is cancelled. If the response is interrupted after verification, retry the same code from the open form; the same operation cannot apply the transfer twice. Delete a Platform identity Platform owners and teammates cannot use ordinary self service account deletion while they still hold Platform access. Remove a teammate through the audited workflow first; they can then use the ordinary deletion flow as a user. Platform owner deletion stays blocked until ownership has been transferred through Discentik Admin Team . After transfer, another Platform owner must remove the former owner's Platform access before ordinary account deletion becomes available. Do not use direct database or Auth deletion as a substitute.

Invite, cancel, and remove Platform teammates through audited access workflows.

Manage Platform Admin team access

Authorised Platform owners and admins use **Discentik Admin → Instructors** to manage
personal Instructor access and discovery settings.

## Instructor settings during early access

Active adult accounts with personal Instructor access can author courses when their
admission and authoring eligibility checks pass. Enabled public registration does not
require a personal beta invitation. Under the invitation-only staged policy, a current
personal invitation is required, including for existing accounts. Account suspension
and the usual account-type restrictions still apply. Registration alone does not
approve authoring, selling or payouts.

Public instructor discovery and profiles are available when their visibility settings
allow it. Making a profile public does not create an account or grant authoring permission.

## Change Instructor settings

Search by name, email, or public display name, then filter by access, verification,
discovery, profile visibility, or suspension state. Results load in bounded pages;
select **Load more** to reach older instructors rather than narrowing a browser-only
snapshot.

Select **View details** to review the account status, course-responsibility count,
seller onboarding and payout readiness, the platform base share, the instructor's
effective seller share, and any recent
sales or earnings summary available for that instructor. When configured, the drawer
also shows the payout country, settlement currency and amount already transferred.
Commercial details stay in
the focused instructor drawer instead of being mixed into the full instructor list.

Review the account type and course-responsibility count before changing a setting.
Enable Instructor access before changing verification or search discovery. An Organisation
account cannot receive personal Instructor access, and profile visibility can change
only after the instructor has created a public profile.

## Record an individual earning agreement

The global seller share applies unless an approved individual agreement exists. In
the instructor drawer, enter the instructor's agreed percentage and an audit reason,
then select **Save individual share**. For example, enter `50` for a 50% instructor
share. The drawer identifies whether the effective percentage comes from an individual
agreement or the global default. The platform base share remains visible beside the
effective share so an individual agreement can be compared with the standard terms.

Individual agreements cannot exceed 50%. Discentik first deducts tax, the actual
Stripe processing fee and the course's frozen AI usage reserve from the sale.
The instructor percentage applies to the remaining distributable net. At least 50%
of that net therefore remains with the platform for infrastructure and operating
margin. Both the maximum instructor share and minimum platform reserve are shown in
the commercial-readiness panel.

Select **Use global default** and record a reason to remove an individual agreement.
Changes apply only to future offers. Existing accepted offers, sales, earnings,
transfers and payouts keep the terms captured when they were created.

Access and discovery changes check the record version. Earning agreements lock the
instructor record while they change. Both workflows commit with a Platform audit
event. If another administrator changed the record, refresh and review the latest
value. If a response is interrupted, retry the unchanged action; its request
identifier confirms the earlier result without applying it twice.

Authorised Platform owners and admins use Discentik Admin → Instructors to manage personal Instructor access and discovery settings. Instructor settings during early access Active adult accounts with personal Instructor access can author courses when their admission and authoring eligibility checks pass. Enabled public registration does not require a personal beta invitation. Under the invitation only staged policy, a current personal invitation is required, including for existing accounts. Account suspension and the usual account type restrictions still apply. Registration alone does not approve authoring, selling or payouts. Public instructor discovery and profiles are available when their visibility settings allow it. Making a profile public does not create an account or grant authoring permission. Change Instructor settings Search by name, email, or public display name, then filter by access, verification, discovery, profile visibility, or suspension state. Results load in bounded pages; select Load more to reach older instructors rather than narrowing a browser only snapshot. Select View details to review the account status, course responsibility count, seller onboarding and payout readiness, the platform base share, the instructor's effective seller share, and any recent sales or earnings summary available for that instructor. When configured, the drawer also shows the payout country, settlement currency and amount already transferred. Commercial details stay in the focused instructor drawer instead of being mixed into the full instructor list. Review the account type and course responsibility count before changing a setting. Enable Instructor access before changing verification or search discovery. An Organisation account cannot receive personal Instructor access, and profile visibility can change only after the instructor has created a public profile. Record an individual earning agreement The global seller share applies unless an approved individual agreement exists. In the instructor drawer, enter the instructor's agreed percentage and an audit reason, then select Save individual share . For example, enter 50 for a 50% instructor share. The drawer identifies whether the effective percentage comes from an individual agreement or the global default. The platform base share remains visible beside the effective share so an individual agreement can be compared with the standard terms. Individual agreements cannot exceed 50%. Discentik first deducts tax, the actual Stripe processing fee and the course's frozen AI usage reserve from the sale. The instructor percentage applies to the remaining distributable net. At least 50% of that net therefore remains with the platform for infrastructure and operating margin. Both the maximum instructor share and minimum platform reserve are shown in the commercial readiness panel. Select Use global default and record a reason to remove an individual agreement. Changes apply only to future offers. Existing accepted offers, sales, earnings, transfers and payouts keep the terms captured when they were created. Access and discovery changes check the record version. Earning agreements lock the instructor record while they change. Both workflows commit with a Platform audit event. If another administrator changed the record, refresh and review the latest value. If a response is interrupted, retry the unchanged action; its request identifier confirms the earlier result without applying it twice.

Find every instructor record and safely change access, verification, search, and profile visibility.

Manage instructor access and discovery

Authorised Platform owners and admins use **Discentik Admin → Taxonomy** to curate the
shared industry choices available to course authors.

Use a short unique key, a clear learner-facing label, and sort order when creating or
editing an industry. Review the course count before archiving: archiving removes the
choice from new selections without erasing existing course assignments. Restore it
when authors should be able to select it again.

Every create, edit, archive, or restore checks the current record version and commits
with its Platform audit event. Refresh and compare the latest values after a conflict.
If a response is interrupted, retry the unchanged request; its request identifier
confirms the earlier result without duplicating the change.

Authorised Platform owners and admins use Discentik Admin → Taxonomy to curate the shared industry choices available to course authors. Use a short unique key, a clear learner facing label, and sort order when creating or editing an industry. Review the course count before archiving: archiving removes the choice from new selections without erasing existing course assignments. Restore it when authors should be able to select it again. Every create, edit, archive, or restore checks the current record version and commits with its Platform audit event. Refresh and compare the latest values after a conflict. If a response is interrupted, retry the unchanged request; its request identifier confirms the earlier result without duplicating the change.

Create, edit, archive, and restore the shared industry choices used by courses.

Manage the course industry taxonomy

AI-assisted review is available in the Platform review workspace. It is not available
for Organisation course approvals; that separate rollout remains disabled by default.

Platform review assistance and private moderation-evidence screening use a dedicated
Platform operations AI credential and provider project. They never consume a learner
or Instructor balance. That project allows its spending budget and alerts to be managed
separately, and the application applies separate daily limits to each operation. If that dedicated
configuration or its platform budget is unavailable, the AI action stops without falling back
to the course-AI credential; manual review remains available.

## Prepare a review draft

1. Open **Discentik Admin**, then **Course reviews**.
2. Claim a public-course revision and open it.
3. Select **AI review** (the sparkle button).
4. Read the suggested category, severity, and message for every checkpoint.
5. Edit or discard each suggestion before adding it as a finding.

The assistant also drafts the decision summary. It does not mark the human checklist
as complete, add findings automatically, request changes, or approve the course.

Public-course moderation requires an independent Platform reviewer. You cannot claim
or decide a public revision that you submitted or whose course you own. Internal
organisation reviews follow the organisation's own governance: an active Organisation Admin
may review a course they submitted when a small team does not have a second approver.

Checkpoint comments, their category and severity, AI assessment labels, and the
decision summary are saved automatically as an internal review draft. Closing and
reopening the review—or handing the claimed review to another Platform reviewer—restores
that draft. Draft comments remain hidden from the course author until a reviewer selects
**Add finding**.

The workspace identifies the reviewer and time of the latest save. If an older browser
tab attempts to save over a newer draft, the save is stopped and the reviewer is asked
to reopen the review; text in the stale tab remains visible until it is closed.

## Complete the human review

Start with **Presentation and cover**. This shows the title, description, requirements,
audience, outcomes, and cover from the submitted revision, not the author's current
draft. Check the cover, misleading claims, each link's destination, personal data,
and copyright or attribution concerns. Record any issues as findings and acknowledge
the presentation checklist before selecting **Checked — next**. Instructor profiles
are managed separately and are not frozen into this preview.
Reconfirm the presentation when reopening a review, including revisions whose
course-details checkpoint was completed in an older workspace.

An unavailable or incomplete automated text check is not a safety pass. The workspace
shows a warning when complete screening cannot be established, including older
screenings without a coverage record. Inspect all text and attachments manually
before deciding. Automated text review does not inspect linked websites, video or
document contents. No automated result replaces the human review.

Before approving, confirm that you inspected every attached resource, each complete
video and audio track, and every linked destination. Browser video samples are only
advisory. This review does not confirm document malware scanning or complete video
and audio screening; do not approve suspicious files. Complete every checkpoint
before this final confirmation becomes available.

Review the submitted course itself, including sections that the assistant marked as
clear. Add only findings that you have verified, then complete every checkpoint. The
Platform reviewer remains responsible for the final approval decision.

After the final decision, **Decision history** shows **Approved** or **Changes
requested** as the primary status for that revision. The completed decision is no
longer labelled as awaiting review.

Large queues, revision histories, checkpoint lists, and finding lists load in bounded
pages. Use **Load more** until the displayed total is complete. Approval remains disabled
while any checkpoint status or finding page is still unloaded, so an older hidden
blocking finding cannot be missed.

Claim changes, checkpoints, findings, resolutions, and decisions are saved together with
their audit record. If another reviewer or browser tab changed the revision first, your
action is stopped and the workspace reloads the current version. Retrying an interrupted
action cannot create a duplicate finding, decision, learner release, or notification.

Select **Return to queue** when another reviewer should take over. This removes your
assignment but preserves completed checkpoints and findings; it never approves the course.

AI assisted review is available in the Platform review workspace. It is not available for Organisation course approvals; that separate rollout remains disabled by default. Platform review assistance and private moderation evidence screening use a dedicated Platform operations AI credential and provider project. They never consume a learner or Instructor balance. That project allows its spending budget and alerts to be managed separately, and the application applies separate daily limits to each operation. If that dedicated configuration or its platform budget is unavailable, the AI action stops without falling back to the course AI credential; manual review remains available. Prepare a review draft 1. Open Discentik Admin , then Course reviews . 2. Claim a public course revision and open it. 3. Select AI review (the sparkle button). 4. Read the suggested category, severity, and message for every checkpoint. 5. Edit or discard each suggestion before adding it as a finding. The assistant also drafts the decision summary. It does not mark the human checklist as complete, add findings automatically, request changes, or approve the course. Public course moderation requires an independent Platform reviewer. You cannot claim or decide a public revision that you submitted or whose course you own. Internal organisation reviews follow the organisation's own governance: an active Organisation Admin may review a course they submitted when a small team does not have a second approver. Checkpoint comments, their category and severity, AI assessment labels, and the decision summary are saved automatically as an internal review draft. Closing and reopening the review—or handing the claimed review to another Platform reviewer—restores that draft. Draft comments remain hidden from the course author until a reviewer selects Add finding . The workspace identifies the reviewer and time of the latest save. If an older browser tab attempts to save over a newer draft, the save is stopped and the reviewer is asked to reopen the review; text in the stale tab remains visible until it is closed. Complete the human review Start with Presentation and cover . This shows the title, description, requirements, audience, outcomes, and cover from the submitted revision, not the author's current draft. Check the cover, misleading claims, each link's destination, personal data, and copyright or attribution concerns. Record any issues as findings and acknowledge the presentation checklist before selecting Checked — next . Instructor profiles are managed separately and are not frozen into this preview. Reconfirm the presentation when reopening a review, including revisions whose course details checkpoint was completed in an older workspace. An unavailable or incomplete automated text check is not a safety pass. The workspace shows a warning when complete screening cannot be established, including older screenings without a coverage record. Inspect all text and attachments manually before deciding. Automated text review does not inspect linked websites, video or document contents. No automated result replaces the human review. Before approving, confirm that you inspected every attached resource, each complete video and audio track, and every linked destination. Browser video samples are only advisory. This review does not confirm document malware scanning or complete video and audio screening; do not approve suspicious files. Complete every checkpoint before this final confirmation becomes available. Review the submitted course itself, including sections that the assistant marked as clear. Add only findings that you have verified, then complete every checkpoint. The Platform reviewer remains responsible for the final approval decision. After the final decision, Decision history shows Approved or Changes requested as the primary status for that revision. The completed decision is no longer labelled as awaiting review. Large queues, revision histories, checkpoint lists, and finding lists load in bounded pages. Use Load more until the displayed total is complete. Approval remains disabled while any checkpoint status or finding page is still unloaded, so an older hidden blocking finding cannot be missed. Claim changes, checkpoints, findings, resolutions, and decisions are saved together with their audit record. If another reviewer or browser tab changed the revision first, your action is stopped and the workspace reloads the current version. Retrying an interrupted action cannot create a duplicate finding, decision, learner release, or notification. Select Return to queue when another reviewer should take over. This removes your assignment but preserves completed checkpoints and findings; it never approves the course.

Prepare a public-course review with AI assistance while keeping the final decision with a Platform reviewer.

Review a public course with AI assistance

## Start with the overview

Open **Overview** in the Platform sidebar. Owners and admins see open cancellation
requests, new accounts from the last seven days, active course reviews and
operational checks requiring attention or unavailable. **Needs attention** links
directly to cancellations, purchase-delivery issues, undelivered invitation emails and
overdue moderation cases. These queues can overlap; do not add them together as a
count of distinct people or incidents.

The cancellation summary lists the purchased course names for up to three of the
oldest open requests. Open the queue for the complete bounded list, purchase details
and usage context; the summary count still includes every open request.

**Recent activity** shows a bounded summary of the newest accounts and course
submissions within seven days, without email addresses. Use the linked queue
for details and **Audit log** for a full investigation. Reviewers and analysts do not
receive the private account or purchase summaries.

The dashboard refreshes every minute while visible and when you return to it. You
can also select **Refresh**. Existing results remain visible during refresh;
**Unavailable** is not a zero count. A failed refresh labels the last successful
update rather than presenting it as current.

## Find cancellation requests

Choose **Purchases and cancellations** directly in the sidebar, immediately below
**Overview**, or open **Open cancellations** on the dashboard. It is no longer
nested under **Accounts**. Owners and admins can review open requests and pending
purchase confirmations. Recording a review is separate from issuing a refund;
follow the purchase review workflow and verify refund evidence before recording a
fully refunded outcome.

## Investigate operational health

Platform Admin tools expose platform-wide operational signals and privileged activity.
Use **Operational health** to review publishing, review-queue, moderation, and audit
signals that may require intervention. Refresh the view before acting on a stale item.

Use **Audit log** to search actions, actors, and targets. The screen loads the newest
bounded page first; select **Load older events** until the full investigation window is
present before searching or choosing **Export loaded view**. Export only when an
authorised investigation or retention process requires it. An audit event records that
an action occurred; it does not by itself establish why the action was taken.

Instructor, taxonomy, AI-rate, credit-adjustment, and Platform-team changes commit
their domain result and Platform audit event together. A failure cannot leave a saved
change without its audit history. If the response is interrupted, retry the unchanged
request from the same page; its retained request identifier confirms the earlier
result without applying it twice. A version-conflict message means another
administrator changed the record, so refresh and review the latest state before
starting a new request.

Start with the narrowest relevant record, confirm the affected account or content, and
keep remediation inside your assigned permissions. Do not change account access merely
to inspect another workspace. Record material decisions through the platform workflow
so later reviewers can reconstruct what happened.

The scheduled Platform operations check runs hourly. **Operational health** shows the
latest durable run, whether it completed fully, overdue moderation cases, and stuck or
failed notification delivery. **Evidence cleanup** separates stale uploads, upload
reconciliations, and evidence whose retention cleanup is overdue. **Account lifecycle
work** separates open, stale, and reconciliation-required account changes. **Access
integrity** counts stale or failed enforcement finalizations and active restrictions
whose live account or course state no longer matches the enforcement record. **Public
image cleanup** counts expired or interrupted cover/profile upload reservations and
records that require reconciliation. Stop further changes on reconciliation-required
records and escalate them to a Platform owner. A partial run is treated as unhealthy
so deferred or failed work cannot look successful.

Platform administrators can expand these totals under **Actionable operational
records**. Each queue is bounded and can load another page without replacing records
already shown:

- **Secure evidence upload cleanup** links the private upload to its moderation case
  and shows status, error, attempts, age, eligibility, lease, and private-object path.
- **Secure evidence retention cleanup** links expired private evidence to its case and
  shows the retention deadline, retry state, worker lease, attempts, and exact private
  object. Records appear only after the case, appeals, enforcements, and legal holds no
  longer block deletion.
- **Account lifecycle recovery** links the affected account and any moderation case,
  and shows the intended status change, version check, attempts, age, and last error.
- **Public image cleanup** links each cover or profile-photo reservation to the upload
  owner and shows its exact public-object path, purpose, eligibility, lease, and retry
  history.
- **Enforcement and access integrity** links the case and affected account when
  available, and shows the ledger identifier, observed live state, age, and failure.

Health-only analysts and reviewers see redacted totals and escalation guidance, not
raw account emails, private-object paths, or case details. Platform administrators can
inspect the bounded records, but only the Platform owner can start recovery or record
an escalation. Ordinary cleanup remains a scheduled operation.

Owner actions always require a reason and the current record state. **Retry cleanup**
claims one exact evidence or public-image row, respects any active worker lease,
rechecks case, legal-hold, attachment, and ownership safety, and uses the existing
token-fenced finalizer after Storage responds. **Retry account recovery** claims one
lifecycle operation, verifies current Auth state, applies only its recorded target,
and uses the atomic account finalizer; access remains fail-closed if verification is
interrupted. **Inspect state** locks the enforcement and case and records its
classification without changing access. A stale pending enforcement offers **Confirm
uncommitted and mark failed** only when the server proves that neither its case event
nor audit finalization committed. Submit any replacement through the linked case.

**Record escalation** preserves the current record version and the owner’s reason in
the audit log, but deliberately does not acknowledge, hide, or resolve the red health
count. Do not delete Storage objects, edit lifecycle or enforcement rows, or replay
appeal tokens outside these workflows. Refresh after every action before proceeding.

The check alerts the case assignee, or active Platform Admins when a case is unassigned,
four hours before an active moderation SLA expires and again after it becomes overdue.
It sends pending moderation email notifications and retries eligible temporary failures
with bounded backoff. A permanent delivery error, unavailable retry content, or eight
failed attempts becomes a terminal dead letter shown under **Unresolved email
deliveries**. Only Platform administrators can inspect recipient details or resolve
this work. Select a case number to open the linked moderation case before acting. First
correct the underlying address, template, or email configuration, then:

- Choose **Requeue email** for an ordinary notification that should be delivered. It
  returns to the bounded retry queue immediately. For an account recipient, the retry
  refreshes the destination from their current registered email. If no deliverable
  address remains, update the account email or acknowledge the delivery instead.
- Choose **Acknowledge** and record a reason when no further delivery should occur. The
  failure stays in the audit trail but leaves unresolved work.
- Choose **Issue fresh appeal link** and record a reason for a failed appeal email. The
  failed bearer link is never replayed; the system creates a new private token and sends
  a new email for the active enforcement. If that replacement cannot be delivered, its
  failure appears as new unresolved work.

Appeal links are stricter because a failed or unconfirmed link is revoked. If a
delivery process stops before it can confirm the send, maintenance revokes that link
after 15 minutes and marks it for operator attention. The raw link cannot be recovered
from the delivery record.

The same maintenance run removes appeal-token records 90 days after the token was used,
revoked, or expired, and deletes private moderation evidence after its 90-day retention
date. Evidence is retained while its case,
enforcement, or appeal is active and while a legal hold applies. If scheduled execution
is unhealthy, treat overdue cases, delayed notifications, and expired evidence as an
operational incident rather than relying on manual reminders.

Public image maintenance separately removes exact-path objects left by expired or
failed course-cover/profile-photo upload reservations, retries bounded cleanup work,
and moves repeatedly failed work to reconciliation. It also removes old terminal
reservation history after its audit window. Use the **Public image cleanup** health
signal to detect a stopped scheduler; do not bypass the reservation or cleanup
workflow with direct public-bucket changes.

Start with the overview Open Overview in the Platform sidebar. Owners and admins see open cancellation requests, new accounts from the last seven days, active course reviews and operational checks requiring attention or unavailable. Needs attention links directly to cancellations, purchase delivery issues, undelivered invitation emails and overdue moderation cases. These queues can overlap; do not add them together as a count of distinct people or incidents. The cancellation summary lists the purchased course names for up to three of the oldest open requests. Open the queue for the complete bounded list, purchase details and usage context; the summary count still includes every open request. Recent activity shows a bounded summary of the newest accounts and course submissions within seven days, without email addresses. Use the linked queue for details and Audit log for a full investigation. Reviewers and analysts do not receive the private account or purchase summaries. The dashboard refreshes every minute while visible and when you return to it. You can also select Refresh . Existing results remain visible during refresh; Unavailable is not a zero count. A failed refresh labels the last successful update rather than presenting it as current. Find cancellation requests Choose Purchases and cancellations directly in the sidebar, immediately below Overview , or open Open cancellations on the dashboard. It is no longer nested under Accounts . Owners and admins can review open requests and pending purchase confirmations. Recording a review is separate from issuing a refund; follow the purchase review workflow and verify refund evidence before recording a fully refunded outcome. Investigate operational health Platform Admin tools expose platform wide operational signals and privileged activity. Use Operational health to review publishing, review queue, moderation, and audit signals that may require intervention. Refresh the view before acting on a stale item. Use Audit log to search actions, actors, and targets. The screen loads the newest bounded page first; select Load older events until the full investigation window is present before searching or choosing Export loaded view . Export only when an authorised investigation or retention process requires it. An audit event records that an action occurred; it does not by itself establish why the action was taken. Instructor, taxonomy, AI rate, credit adjustment, and Platform team changes commit their domain result and Platform audit event together. A failure cannot leave a saved change without its audit history. If the response is interrupted, retry the unchanged request from the same page; its retained request identifier confirms the earlier result without applying it twice. A version conflict message means another administrator changed the record, so refresh and review the latest state before starting a new request. Start with the narrowest relevant record, confirm the affected account or content, and keep remediation inside your assigned permissions. Do not change account access merely to inspect another workspace. Record material decisions through the platform workflow so later reviewers can reconstruct what happened. The scheduled Platform operations check runs hourly. Operational health shows the latest durable run, whether it completed fully, overdue moderation cases, and stuck or failed notification delivery. Evidence cleanup separates stale uploads, upload reconciliations, and evidence whose retention cleanup is overdue. Account lifecycle work separates open, stale, and reconciliation required account changes. Access integrity counts stale or failed enforcement finalizations and active restrictions whose live account or course state no longer matches the enforcement record. Public image cleanup counts expired or interrupted cover/profile upload reservations and records that require reconciliation. Stop further changes on reconciliation required records and escalate them to a Platform owner. A partial run is treated as unhealthy so deferred or failed work cannot look successful. Platform administrators can expand these totals under Actionable operational records . Each queue is bounded and can load another page without replacing records already shown: Secure evidence upload cleanup links the private upload to its moderation case and shows status, error, attempts, age, eligibility, lease, and private object path. Secure evidence retention cleanup links expired private evidence to its case and shows the retention deadline, retry state, worker lease, attempts, and exact private object. Records appear only after the case, appeals, enforcements, and legal holds no longer block deletion. Account lifecycle recovery links the affected account and any moderation case, and shows the intended status change, version check, attempts, age, and last error. Public image cleanup links each cover or profile photo reservation to the upload owner and shows its exact public object path, purpose, eligibility, lease, and retry history. Enforcement and access integrity links the case and affected account when available, and shows the ledger identifier, observed live state, age, and failure. Health only analysts and reviewers see redacted totals and escalation guidance, not raw account emails, private object paths, or case details. Platform administrators can inspect the bounded records, but only the Platform owner can start recovery or record an escalation. Ordinary cleanup remains a scheduled operation. Owner actions always require a reason and the current record state. Retry cleanup claims one exact evidence or public image row, respects any active worker lease, rechecks case, legal hold, attachment, and ownership safety, and uses the existing token fenced finalizer after Storage responds. Retry account recovery claims one lifecycle operation, verifies current Auth state, applies only its recorded target, and uses the atomic account finalizer; access remains fail closed if verification is interrupted. Inspect state locks the enforcement and case and records its classification without changing access. A stale pending enforcement offers Confirm uncommitted and mark failed only when the server proves that neither its case event nor audit finalization committed. Submit any replacement through the linked case. Record escalation preserves the current record version and the owner’s reason in the audit log, but deliberately does not acknowledge, hide, or resolve the red health count. Do not delete Storage objects, edit lifecycle or enforcement rows, or replay appeal tokens outside these workflows. Refresh after every action before proceeding. The check alerts the case assignee, or active Platform Admins when a case is unassigned, four hours before an active moderation SLA expires and again after it becomes overdue. It sends pending moderation email notifications and retries eligible temporary failures with bounded backoff. A permanent delivery error, unavailable retry content, or eight failed attempts becomes a terminal dead letter shown under Unresolved email deliveries . Only Platform administrators can inspect recipient details or resolve this work. Select a case number to open the linked moderation case before acting. First correct the underlying address, template, or email configuration, then: Choose Requeue email for an ordinary notification that should be delivered. It returns to the bounded retry queue immediately. For an account recipient, the retry refreshes the destination from their current registered email. If no deliverable address remains, update the account email or acknowledge the delivery instead. Choose Acknowledge and record a reason when no further delivery should occur. The failure stays in the audit trail but leaves unresolved work. Choose Issue fresh appeal link and record a reason for a failed appeal email. The failed bearer link is never replayed; the system creates a new private token and sends a new email for the active enforcement. If that replacement cannot be delivered, its failure appears as new unresolved work. Appeal links are stricter because a failed or unconfirmed link is revoked. If a delivery process stops before it can confirm the send, maintenance revokes that link after 15 minutes and marks it for operator attention. The raw link cannot be recovered from the delivery record. The same maintenance run removes appeal token records 90 days after the token was used, revoked, or expired, and deletes private moderation evidence after its 90 day retention date. Evidence is retained while its case, enforcement, or appeal is active and while a legal hold applies. If scheduled execution is unhealthy, treat overdue cases, delayed notifications, and expired evidence as an operational incident rather than relying on manual reminders. Public image maintenance separately removes exact path objects left by expired or failed course cover/profile photo upload reservations, retries bounded cleanup work, and moves repeatedly failed work to reconciliation. It also removes old terminal reservation history after its audit window. Use the Public image cleanup health signal to detect a stopped scheduler; do not bypass the reservation or cleanup workflow with direct public bucket changes.

Use operational health and audit views to investigate platform-wide issues responsibly.

Monitor platform operations and audit activity

Open **Discentik Admin** > **Analytics** to review aggregated learning activity across
Discentik. Access requires the Platform analytics permission. The figures are calculated
on the server across the authorised platform-wide dataset, so the screen is not limited
to the records that happen to fit in a browser request.

Choose a course and an all-time, 30-day, 90-day, or 12-month period. Changing either
filter reloads the aggregates for that exact selection. **Refresh** updates the current
view. If a refresh fails, the screen labels the error and may retain the last successful
figures for that same selection; do not treat them as current until refresh succeeds.

The summary and course table show distinct learners, stage activity, pass rate, learning
effort, completions, and active time. Engagement signals describe recorded interactions
such as hints, retries, ratings, and revisits. They are indicators for investigation,
not proof of learner intent or course quality on their own.

**Official learning** includes only qualifying first-pass activity that can update
progress, results, completion, and certificates. **Practice activity** separately shows
module review before completion and continued interaction after completion. Practice can
use AI balance and retain attempts or artifact revisions, but it does not change the
official result. Use these labels when comparing learning outcomes with ongoing use and
platform cost.

The **Activity over time** chart always covers the latest 30 calendar days within the
selected filters, even when the selected reporting period is all time, 90 days, or 12
months. Use the generated timestamp below the results to confirm how current the view is.

Learners who opt out of analytics are excluded before aggregation. Raw learner
identifiers are not sent to the Platform Admin screen. Results with small counts can
still be sensitive when combined with other knowledge, so share screenshots and exports
only for an authorised operational purpose.

Choose **Export current view** to download the per-course aggregates shown by the current
course and period filters. The export does not contain learner-level rows. Store and
delete it under the same access, privacy, and retention rules as other Platform reports.

Open Discentik Admin Analytics to review aggregated learning activity across Discentik. Access requires the Platform analytics permission. The figures are calculated on the server across the authorised platform wide dataset, so the screen is not limited to the records that happen to fit in a browser request. Choose a course and an all time, 30 day, 90 day, or 12 month period. Changing either filter reloads the aggregates for that exact selection. Refresh updates the current view. If a refresh fails, the screen labels the error and may retain the last successful figures for that same selection; do not treat them as current until refresh succeeds. The summary and course table show distinct learners, stage activity, pass rate, learning effort, completions, and active time. Engagement signals describe recorded interactions such as hints, retries, ratings, and revisits. They are indicators for investigation, not proof of learner intent or course quality on their own. Official learning includes only qualifying first pass activity that can update progress, results, completion, and certificates. Practice activity separately shows module review before completion and continued interaction after completion. Practice can use AI balance and retain attempts or artifact revisions, but it does not change the official result. Use these labels when comparing learning outcomes with ongoing use and platform cost. The Activity over time chart always covers the latest 30 calendar days within the selected filters, even when the selected reporting period is all time, 90 days, or 12 months. Use the generated timestamp below the results to confirm how current the view is. Learners who opt out of analytics are excluded before aggregation. Raw learner identifiers are not sent to the Platform Admin screen. Results with small counts can still be sensitive when combined with other knowledge, so share screenshots and exports only for an authorised operational purpose. Choose Export current view to download the per course aggregates shown by the current course and period filters. The export does not contain learner level rows. Store and delete it under the same access, privacy, and retention rules as other Platform reports.

Review privacy-aware learning signals across Discentik without exposing learner-level records.

Read platform learning analytics

Platform Admins with analytics access can review anonymous responses from published
Help Centre guides.

## Open Help Centre feedback

1. Open the **Discentik Admin** workspace.
2. Select **Help feedback** in the navigation.
3. Use **Refresh** when you want to load the latest responses.

The summary shows the total number of responses, how many were helpful, and the
overall helpful rate. The guide table shows the same signals for each published guide.

## Decide what needs attention

Start with guides that have several responses and a lower helpful rate. Open a guide
from its title, follow the instructions as a user would, and check that the names and
steps still match the platform.

A guide with no responses is not necessarily a problem. It may be new or receive less
traffic. Avoid drawing conclusions from a single response.

## How responses are handled

The Help Centre records one effective **Yes** or **No** choice per guide. For a
signed-in reader, the choice is linked to their account so submitting again from
another browser updates the same response. For a signed-out reader, the choice is
linked to an anonymous identifier stored in that browser. The analytics view shows
aggregated counts, not individual readers.

A reader can change their choice, which replaces the earlier response instead of
adding another one. Submission limits run in the background to protect the results
from automated or repeated voting. Readers who exceed the normal allowance may be
asked to complete a security check before continuing.

Platform Admins with analytics access can review anonymous responses from published Help Centre guides. Open Help Centre feedback 1. Open the Discentik Admin workspace. 2. Select Help feedback in the navigation. 3. Use Refresh when you want to load the latest responses. The summary shows the total number of responses, how many were helpful, and the overall helpful rate. The guide table shows the same signals for each published guide. Decide what needs attention Start with guides that have several responses and a lower helpful rate. Open a guide from its title, follow the instructions as a user would, and check that the names and steps still match the platform. A guide with no responses is not necessarily a problem. It may be new or receive less traffic. Avoid drawing conclusions from a single response. How responses are handled The Help Centre records one effective Yes or No choice per guide. For a signed in reader, the choice is linked to their account so submitting again from another browser updates the same response. For a signed out reader, the choice is linked to an anonymous identifier stored in that browser. The analytics view shows aggregated counts, not individual readers. A reader can change their choice, which replaces the earlier response instead of adding another one. Submission limits run in the background to protect the results from automated or repeated voting. Readers who exceed the normal allowance may be asked to complete a security check before continuing.

Use anonymous guide feedback to find documentation that needs improvement.

For administrators

Guides