Как организовать policy enforcement для LLM/AI-продукта: content moderation pipeline, severity tiers, refusal patterns и escalation runbook?

Policy enforcement = defense in depth: input filter → LLM → output filter, ни один слой не доверяется единолично. Stack: Llama Guard 3 / OpenAI Moderation / AWS Bedrock Guardrails + Microsoft Presidio для PII. Severity tiers: P0 (child safety, self-harm, imminent violence — 15 min response) → P1 (hate, drugs, weapons — 1 hr) → P2 (controversial — 24 hr) → P3 (edge cases — weekly). Refusal patterns: hard refusal (illegal), soft refusal с alternative, clarifying question, partial fulfillment. Runbook: Detect → Triage → Notify → Escalate (T&S/Legal/PR/Crisis line) → Resolve → Postmortem (P0/P1 mandatory). Без structured escalation продукт получает Character.AI-уровень incident.