Risk

A risk policy combines signals from risk providers with configurable rules and risk scoring. The policy returns one of the results you define, and the configuration that uses the policy determines what happens for each result.

Risk providers are configured separately and supply the signals evaluated by risk policies. Built-in providers are available for geolocation and phone risk evaluation.

How risk policies work

A risk policy contains four main components:

• Results: The outcomes the policy can return. You can define up to six results based on the decisions you need to make.
• Signals: Risk information obtained from configured risk providers. A policy can use multiple signals and map the data required by each provider.
• Risk rules: Ordered conditions that evaluate available risk information. The first matching rule returns its configured result and ends rule evaluation.
• Risk scoring: An optional scoring model that evaluates when no risk rule matches. Signals can contribute to a total score, which is mapped to one of the policy results.

This separates risk evaluation from the action taken afterward. For example, the same risk policy can return results such as low, medium, and high, while the configuration using the policy determines how those results affect the customer journey.

Where risk policies are used

Risk policies can be used in different parts of the customer journey:

• Adaptive Access: Use a risk policy instead of basic Adaptive Access rules and map its results to Adaptive Access actions.
• Identity Verification: Add a risk policy evaluation to an Identity Verification policy and map its results to verification outcomes.
• Journey Builder: Add a Risk Policy Evaluation step and branch the journey based on the result returned by the policy.