Create a risk policy

A risk policy can combine ordered risk rules with risk scoring. Risk rules return a result when a defined condition matches. If no rule matches, risk scoring or the policy's default result determines the outcome.

Create the policy

1. Log in to the Admin Console.
2. From the left-hand menu, select Policies > Risk.
3. Select Create risk policy.
4. Enter a Name.
5. Optionally, enter a Description and select a Policy tag.
6. Configure the Results, Signals, Risk rules, and Risk scoring tabs.
7. Select Save.

Results

Results are the outcomes a risk policy can return. You can define up to six results.

Define results based on the decisions the policy needs to distinguish. For example, a policy used for authentication could return step-up, step-down, and block.

To add a result:

1. Select the Results tab.
2. Select Add result.
3. Enter the result.
4. Repeat for each required outcome.

The configuration that uses the risk policy determines what happens for each result.

Signals

Signals provide the risk information evaluated by the policy. Add signals from the risk signal sources configured for the instance.

Signals are queried when the policy is evaluated. Outputs from each source are exposed as read-only local variables using the source instance name and variable name:

source_name.variable_name

To configure signals:

1. Select the Signals tab.
2. Select Add signal and choose a risk signal source.
3. Configure the inputs required by the source.
4. Configure whether the signal is a Required signal.
5. Configure Query every time as needed.
6. Repeat for each signal the policy should evaluate.

If a required signal fails, the risk policy evaluation ends with an error, and the configuration using the policy determines how the error is handled.

If an optional signal fails:

• The evaluation continues.
• Its variables remain unset.
• It does not contribute to risk scoring.
• Risk rules that reference it do not match.

Risk rules

Risk rules evaluate conditions in priority order. The first matching rule returns its configured result and stops rule evaluation.

To configure risk rules:

1. Select the Risk rules tab.
2. Select Add rule.
3. Define the conditions to evaluate.
4. Select the result to return when the conditions match.
5. Repeat for each required rule.
6. Drag the rules to change their priority.

Risk rules can use values available during the evaluation, including signal outputs.

Risk scoring

Risk scoring combines contributions from selected signals into a total score and maps that score to one of the policy's results.

Scoring runs only when no risk rule matches.

To configure risk scoring:

1. Select the Risk scoring tab.
2. Enable Use risk scoring.
3. Under Score contributions, select Add signal.
4. Select a signal from the signals configured for the policy.
5. Enter the score contribution for the signal's Medium and High levels.
6. Repeat for each signal that should contribute to the score.

The contributions from the selected signals are added together. The Highest possible score is displayed, calculated from the highest configured contributions.

Score bands

Score bands map the total risk score to a policy result.

Under Score bands:

1. Define the thresholds for each score band.
2. Select the result returned for each band.
3. Select Add band to add more thresholds as needed.

Score bands use ascending thresholds. The lowest band starts at 0, and the highest band is open-ended, so every possible score maps to exactly one result.

Delete a risk policy

To delete a risk policy, open the policy and select Delete risk policy under Danger zone.

A risk policy cannot be deleted while another policy or a journey step references it. Remove those references before deleting the risk policy.