The problem
The client operates a streaming brand with a large licensed catalog. Short-form editors cut clips for social and for the service's own rails. The catalog team maintained the rights record: territory, window, and whether a title could be clipped at all. Editors were checking that record when they remembered, in a spreadsheet export that was already a day old. A clip from a title outside the window had reached publish and been pulled.
The content lead wanted the check in the path, not in a guideline. If the title is not in the rights catalog for that use, it does not enter the publish queue. An editor can still argue the exception, to a person, not to the model.
Why the catalog is a gate
A model that 'reviews' a clip and writes a confidence score does not know the contract. The contract is the catalog row: title id, territory, window, clip allowed. The gate is a join on that row. The model is not asked whether the clip seems fair.
Architecture
The title id is required before upload completes
An edit that does not carry a catalog title id cannot be submitted. Editors pick the title from the catalog, which removes the free-text title that was matching the wrong row.
Window and territory are evaluated at submit time
The gate reads the catalog then, not the morning export. A window that closed yesterday fails. A territory the account is not allowed to publish into fails. The failure names the field.
Out of catalog means out of the queue
There is no 'publish anyway' on the editor's screen. An exception is a request to the rights manager, who can clear a one-time use in the catalog. The queue only accepts a catalog pass.
The editor still publishes
Passing the gate does not post the clip. The editor's publish action is unchanged. The gate removed a class of mistake. It did not take the release.
Challenges and tradeoffs
- Catalog ids and edit-project ids were different namespaces. Editors stored a project name. The first join missed and blocked almost everything, which the team read as the gate being broken. We mapped project to title once, in the editing tool, and the gate only sees the catalog id.
- A title can be licensed for the service and not for social. The catalog has a use field. We had joined on title only, and a social cut of a service-only title passed. The gate now takes the destination the editor selected, and the catalog has to allow that destination.
- Windows stored as dates were timezone-sensitive. A window ending on a date was interpreted as the editor's laptop time. It is now the catalog's stated zone, and the failure message includes the zone so a late-night submit is not a surprise.
Results
After the gate was on, every clip that entered the publish queue in the review window carried a catalog title id that passed territory, window, and use. Review found no out-of-catalog clip in that queue. Editors still pressed publish. Exceptions went to the rights manager as catalog changes, which is the record the client wanted.
The pulled-clip incident was a missing check, not a close call by an editor. The check is now the path.
What we'd do differently
We would have read the use field in the first join. Title-only matching felt complete because the incident we were shown was an expired window, and the social-versus-service case was sitting in the same table.