Abuse management is usually secretive because if you publish the "rules of non-abusive behavior", you end up with a bunch of behavior that complies with the official rules while still being abusive.

Because of the value in subverting abuse systems such as Yelp ratings or Google SEO, these teams usually are handled differently with an entirely different threat model - which is why they may be referred to as "secretive".

What do the threat models usually look like?