# Tezeit (tezeit.com) — Full Technical Reference & Architecture for AI Agents > Canonical full documentation file for LLMs, AI agents, and integration developers. --- ## 1. Executive Summary & Product Overview Tezeit (`https://tezeit.com`) is a multi-tenant SaaS cybersecurity and moderation platform designed for Telegram community groups, channels with discussion boards, and professional communities. Traditional Telegram moderation bots rely either on crude binary keyword blacklists (leading to severe false positives) or on unconstrained AI calls (slow, expensive, and non-deterministic). Tezeit solves this by combining: 1. **Deterministic Rule Engine (Layer 1):** Millisecond evaluation of profile heuristics, message structure, and behavioral history with customizable weights. 2. **Multi-Modal AI Audit (Layer 2):** Targeted LLM and Vision models deployed strictly in ambiguous "gray zones" (review thresholds) under daily budget controls. 3. **No-Code Moderation Funnels (Layer 3):** Programmable decision pipelines (Allow, Review, Mute / Soft-ban, Kick, Ban) customizable per chat via a CRM-like interface. 4. **Human-in-the-Loop Console (Layer 4):** A real-time web dashboard for telemetry, alert rules, rule calibration, and audit logging. --- ## 2. Moderation Engine & Request Pipelines The Tezeit engine strictly decouples **Suspicion Scoring** (a normalized score from 0 to 100) from **Action Enforcement** (what action to execute on Telegram). ``` Incoming Telegram Update (Join Request / Message) │ ▼ [Fact Extraction & Profile Context] │ ▼ [Deterministic Scoring (Profile + Content + Behavior)] │ Score 0–100 Computed │ ┌─────┴──────────────────┐ ▼ ▼ Score ≤ Allow Score ≥ Review (Clear) (Ambiguous or Severe) │ │ │ ├─► Is AI Scoring Eligible? (Review Zone + Text/Invite criteria) │ │ └─► Run LLM Scorer → Adjust Score ▼ ▼ Verdict: ALLOW Verdict: REVIEW or BLOCK │ │ └────────────────────────┴───────────────┐ ▼ [Funnel Pipeline Engine] │ ┌──────────────┴──────────────┐ ▼ ▼ Mode: dry_run Mode: live (Log to Journal) (Execute Telegram Action) ``` ### 2.1 Join-Request Pipeline Executed when a user requests to join a private or gated group/channel (`chat_join_request`): 1. **Context Lookup:** Resolves tenant, chat identity, and user record. 2. **Fact Gathering:** - Profile completeness (avatar presence, first/last name presence). - Name entropy & character set analysis (unusual Unicode, homoglyphs, symbol-only names). - Account age estimation (credit applied for established accounts). - Bio analysis (presence of hidden links, phone numbers, cross-chat references). - Global bot registry lookups (known spam/bot lists). - Tenant-scoped pHash matching (comparing avatar hash against verified bot clusters). 3. **Scoring & Decision:** Evaluates weighted profile rules, persists a decision record in PostgreSQL, and routes the join request to auto-approve, manual review queue, or rejection. ### 2.2 Message Moderation Pipeline Executed on every new message and message edit (`message`, `edited_message`): 1. **Advisory Serialization:** Uses a transaction-scoped lock on `(chat, user)` to serialize rapid message bursts from the same user, ensuring accurate historical analysis. 2. **Short-Circuit Gates:** - Active mute enforcement: removes messages from currently muted users. - Open-chat first-message quarantine: routes new unknown participants through soft-ban validation. 3. **Trust Graduation:** Long-standing participants with verified message history earn "trusted" status (`user.trusted`), which grants a score credit and skips expensive cross-chat / LLM lookups. 4. **Content & Behavior Scoring:** - Message text, captions, and forwarded origins are evaluated against configured keyword groups and syntax patterns. - Behavioral history is analyzed (message frequency bursts, duplicate message spam across chats, link-after-warmup patterns, fast replies to channel posts, reaction spam). 5. **LLM Gate Admission (Gray-Zone Evaluation):** - A message triggers LLM evaluation **only** if all conditions are met: 1. The initial heuristic verdict is `review` (or forced quarantine). 2. AI scoring feature is enabled for the tenant. 3. Daily usage cap is not exceeded. 4. Content length is ≥ 16 characters **or** contains hidden invite link hashes (`t.me/+...` in text, anchor links, or inline buttons). 6. **Prompt Injection Hardening:** All user metadata and untrusted message fragments sent to AI models are sanitized (control characters stripped, metadata bounded, and explicitly tagged as untrusted data in system prompts). 7. **Action Dispatch:** If the funnel is in `live` mode, executes Telegram actions (delete message, soft-ban / mute, kick, or ban) with automatic cleanup of recent spam messages. --- ## 3. Signal & Rule Catalog Signals are categorized into four core layers. All weights are configurable per chat (defaulting to calibrated system baselines). ### 3.1 Profile Signals (Evaluated at Join & First Message) - `profile.photo_missing`: User account has no profile picture. - `profile.name_missing`: Missing display name. - `profile.name_symbols_only`: Name contains only emojis or punctuation. - `profile.name_unusual_charset`: Mixed alphabets or homoglyph spoofing. - `profile.username_many_digits`: Username ends with excessive random digits (e.g. `@user98412948`). - `profile.bio_link`: Link found in user biography. - `profile.bio_link_new_member`: Link in bio from an account created recently. - `profile.bio_phone_or_messenger`: Phone number or external messenger handle in bio. - `profile.cas_banned`: Listed in global Telegram spammer databases. - `profile.tenant_banned`: Previously banned by a moderator within the current tenant workspace. - `profile.avatar_phash_match`: Avatar perceptual hash matches known bot avatars. ### 3.2 Message Content Signals - `message.adult_keyword`: Matches 18+ / NSFW keyword patterns. - `message.scam_keyword`: Matches financial fraud, crypto giveaway, or phishing patterns. - `message.pharma_keyword`: Matches unlicensed pharmaceutical or illegal substance terms. - `message.link`: Contains standard external URLs. - `message.links_only`: Message body consists solely of a URL. - `message.too_many_links`: Message contains multiple external links. - `message.has_keyboard`: Message contains inline button keyboards with external URLs. - `message.forwarded`: Message is forwarded from an external channel or user. - `message.sender_is_channel`: Message posted anonymously on behalf of a Telegram channel. - `message.first_message`: The user's very first message in the community. - `message.multi_lang_words`: Homoglyph obfuscation (e.g., Cyrillic characters replacing Latin letters). - `message.too_many_mentions`: Excessive user tagging (`@user`). - `message.too_many_emoji`: Excessive emoji count designed to bypass regex filters. ### 3.3 Behavioral Signals - `behavior.message_burst`: 3+ messages sent within 60 seconds by an unverified user. - `behavior.duplicate_text`: Same message text posted repeatedly. - `behavior.link_after_warmup`: User posts clean casual messages followed immediately by a promotional link. - `behavior.cross_chat_spam`: Identical text detected across multiple chats in the workspace. - `behavior.dormant_activation`: Account was silent for weeks and suddenly started posting links. - `behavior.short_msg_flood`: Flood of single-word or very short messages. - `behavior.fast_reply_to_post`: Reply sent in under 2 seconds after an admin post (bot scraper behavior). - `behavior.reaction_flood`: Mass reacting to recent messages to surface an abusive profile. - `behavior.negative_reaction_targeting`: Coordinated negative reactions used to harass authors. ### 3.4 AI Signals - `message.llm_spam`: LLM confirms message is malicious spam, scam, or bot solicitation. - `message.llm_pardon`: LLM confirms message is a benign false positive (applies score reduction). - `message.llm_neutral`: LLM assessment is ambiguous. - `user.trusted`: High-reputation community member (applies score credit, reduces total risk). --- ## 4. Programmable Funnel Engine & Raid Protection ### 4.1 Funnel Architecture Moderation pipelines operate on an explicit state machine: - **Stages:** Entry → Profile Audit → Content Audit → Behavioral Check → Decision → Action. - **Enforcement Modes:** - `off`: Funnel is completely disabled. - `dry_run`: Decisions, rule hits, and scores are computed and logged in the database, but NO actions (bans/deletions) are sent to Telegram. Ideal for onboarding and threshold calibration. - `live`: Full production mode where actions are immediately executed on Telegram. ### 4.2 Raid Mode Defense Raid Mode is an emergency override mechanism for active bot raids: - **Trigger:** Activated automatically on sudden anomalous join spikes or manually by an admin via the dashboard. - **Behavior:** Overrides standard funnel thresholds to temporarily reject or freeze all new join requests. Whitelisted users retain immunity. - **Auto-Expiry:** Automatically turns off after a preset cooldown window (e.g., 2 hours) to avoid permanent disruption. --- ## 5. Getting Started: Chat Setup Guide ### Step 1: Add Bot to Telegram Chat 1. Add the official Tezeit bot (or your dedicated BYOB bot) to your Telegram group or channel. 2. Grant the bot Administrator permissions: - *Delete Messages* (mandatory for cleanup). - *Ban Users* (mandatory for kicking/banning malicious actors). - *Invite Users via Link* (for join request management). ### Step 2: Access Web Console 1. Navigate to `https://app.tezeit.com`. 2. Sign in using Google, Telegram, or Email via Single Sign-On (`https://auth.tezeit.com`). 3. Your personal workspace is provisioned automatically with `Free` tier access. ### Step 3: Configure Funnel in Observation Mode 1. Select your chat from the **Chats** tab. 2. Verify that the moderation mode is set to `dry_run` (Observation). 3. Monitor the **Journal** and **Activity** views for 24–48 hours to inspect scores and calibrate rule weights to your community's tolerance. ### Step 4: Switch to Live Enforcement 1. When satisfied with the calibration, switch the funnel mode to `live`. 2. The bot will now actively safeguard the chat according to your configured funnel rules. --- ## 6. Multi-Tenancy, Team Workspaces & Identity Management - **Identity & Access:** Centralized Single Sign-On (SSO) authentication supporting Google, Telegram OAuth, and corporate Email verification. - **Workspace Isolation:** All bot data, chat settings, rule weights, and logs are strictly isolated by workspace (`tenant_id`). - **Team Roles:** - `owner`: Full control, billing management, workspace deletion. - `admin`: Chat configuration, rule weight adjustment, funnel editing, member invitations. - `moderator`: Reviewing decision journals, approving/declining join requests, manual actions. - `viewer`: Read-only access to stats, journals, and logs. - **BYOB (Bring Your Own Bot):** Tenants on supported plans can connect their own Telegram bot tokens, keeping community interactions branded to their own bot identity. --- ## 7. Pricing & Subscription Plans Tezeit operates on a daily wallet-based billing model (prepaid balance, charged daily without locked annual contracts). | Plan | Price (Daily / Monthly) | Active Chats | Key Features | |---|---|---|---| | **Free** | $0 / $0 | Up to 2 chats | Basic heuristic rules, funnel viewing (`dry_run`), decision journal, broadcast tools. | | **Pro** | $0.33/day (≈ $10/mo) | Up to 10 chats | Full signal catalog, live funnel enforcement (`live`), Raid Mode, alert rules, rule constructor. | | **Pro+** | $0.66/day (≈ $20/mo) | Unlimited chats | Multi-chat clusters, advanced telemetry, data export, external OSINT lookups. | | **Pro AI** | $1.00/day (≈ $30/mo) | Unlimited chats | Everything in Pro+, plus LLM gray-zone message scoring and AI avatar vision analysis. | --- ## 8. Security & Data Integrity Invariants 1. **Data Isolation:** All moderation data and chat configurations reside in isolated application datastores, strictly separated from authentication records. 2. **Transactional Safety:** Decision records and message audits are persisted inside ACID transactions before actions are dispatched. 3. **Zero Secret Leakage:** Telegram bot tokens and managed credentials are encrypted at rest with AES-256-GCM. 4. **Resilient Fail-Open:** In the event of external network outages (e.g. AI provider API failure), the system fails open or falls back to heuristic scoring without interrupting community chat flow. --- ## 9. Official Support & Communications - **Telegram Support Bot:** [@tezeit_support_bot](https://t.me/tezeit_support_bot) — 24/7 automated assistant and live support channel. - **Corporate Support Email:** [support@tezeit.com](mailto:support@tezeit.com) — Inquiries, billing, enterprise partnerships. - **Web App Console:** [https://app.tezeit.com](https://app.tezeit.com) - **Official Website:** [https://tezeit.com](https://tezeit.com)