Risk policy step

A step in the Journey Builder is a component used to configure and customize login, registration, or self-service workflows.

The Risk policy step evaluates a risk policy and branches the journey on its outcome. The step exposes one output node for each of the policy's results, plus a distinct error output. All evaluation logic (signals, rules, and scoring) stays in the risk policy, where it can be reused and reasoned about; the journey only decides where each outcome leads.

Capabilities

• Evaluates any defined risk policy at any point in the journey.
• Branches the journey on the policy's named results, such as step-up, step-down, or block.
• Routes evaluation errors to a dedicated error branch, following the same convention as other steps (compare the identity verification step's success, notAvailable, and failure outputs).
• Makes signal outputs available to later steps: outputs mapped to local variables during the evaluation can be read by subsequent conditions and steps, and are passed to lifecycle event hooks.

Sample use cases

• Re-evaluate risk before a sensitive action mid-journey, such as a payment or a profile change, and require MFA on a step-up result.
• Route risky registrations into an identity verification flow while clean ones proceed directly.
• Send blocked customers to a dedicated message step that tells them how to contact support.

Configuration

To add a Risk policy step to your journey:

1. Open the Journey Builder in the left-hand menu.
2. Create a new journey or select an existing one to edit.
3. Select the + icon and choose Risk policy.
4. Select the pencil icon to configure the step. You can optionally rename the step.
5. Select the risk policy to evaluate. Only policies whose needs can be satisfied at this point in the journey are offered.
6. Connect each output node to the step that should follow it. The step shows one node per result, plus error.

The error output must be connected: what happens on an evaluation error is configured to ensure that evaluations never fail open.

Outcomes

This step returns the following outcomes:

• One outcome per policy result: The policy's evaluation selected that result, through a matching rule, the score band, or the default result.
• error: The evaluation could not produce a result, for example because a required signal failed after its retry logic was exhausted.

Notes and limitations

• A risk policy's results can't be edited while a journey step references the policy, so the step's output nodes always match the policy.
• Signal results are cached per session. If an earlier evaluation in the same session already queried a signal with the same inputs, the step reuses the cached result unless the signal is configured to query every time.
• A policy can define up to six results, so a step exposes at most seven output nodes including error.