Risk policy mode

Adaptive Access evaluates information available during authentication and applies the action configured for the resulting risk decision. You can define those decisions directly in the adaptive access policy or use a reusable risk policy that combines risk signals, rules, and risk scoring.

Adaptive rules have two modes:

• Basic rules: Use the existing Adaptive Access blocking, step-up, and step-down rules.
• Risk policy: Uses risk policies to make Adaptive Access decisions.

Risk policy mode separates evaluation into stages before and after customer identification. This lets you apply early blocking controls before identification, then evaluate additional risk once information about the customer is available.

How risk policy mode works

Risk policy mode evaluates Adaptive Access in the following order:

1. Before identification blocking checks evaluate the request using the existing IP address, location, anonymous proxy/Tor, and bot detection controls.
2. If those checks do not block the request, an optional risk policy can evaluate before the customer is identified.
3. After the customer is identified, an optional risk policy can evaluate during authentication.

Each selected risk policy returns one of its configured results. Adaptive Access maps each result to an action appropriate for that stage.

For example, a result returned before identification can be mapped to Block or Allow, while a result returned during authentication can be mapped to Step up, Step down, or Block.

Choose the rule mode

1. Log in to the Admin Console.
2. From the left-hand menu, select Policies > Adaptive access.
3. Open an adaptive access policy.
4. Select the Adaptive rules tab.
5. Under Rule mode, select Risk policy.

Before identification

The Before identification section evaluates before the customer is identified.

Blocking controls

The section includes the same blocking controls available in Basic rules mode:

• IP address
• Location
• Anonymous proxy / Tor
• Bot detection

These checks run before risk policy evaluation. If a blocking condition matches, the request is blocked, and the risk policy is not evaluated.

Risk policy

You can optionally select a risk policy to evaluate if the blocking controls do not block the request.

To configure it:

1. Under Risk policy, select a risk policy.
2. For each Policy result, select an action:
   1. Block
   2. Allow
3. Under On evaluation error, select the action to take if the risk policy cannot be evaluated successfully.

Allow lets processing continue to the next stage.

Authentication

The Authentication section is evaluated after the customer is identified.

You can optionally select a risk policy for this stage and map each of its results to an authentication action.

To configure it:

1. Under Risk policy, select a risk policy.
2. For each Policy result, select the corresponding Adaptive Access action:
   1. Step up
   2. Step down
   3. Block
3. Under On evaluation error, select the action to take if the risk policy cannot be evaluated successfully.

The available policy results come from the selected risk policy. For example, a policy with step-up, step-down, and block results provides a separate action mapping for each result.

Evaluation errors

Both risk policy sections include an On evaluation error setting.

Use this setting to determine what Adaptive Access should do when the selected risk policy cannot complete its evaluation successfully. The available actions depend on whether the evaluation occurs before identification or during authentication.