Service details

Application details

AWS IAM Identity Center: the NameID must equal the Identity Center user name (the email). Import the application's metadata to fill the entity ID and the ACS URL.

Federation details

Active: the model may require a passkey, a phone approval or a second approver above your policy. It never lowers your policy and never refuses on its own; if it is unavailable, a phishing-resistant factor is required.

Enforced response policy

With the behaviour model active, this policy is applied at sign-in, step-up, phone approval, privileged access and administrators' sensitive actions. It can only ask for more verification. In shadow mode its decision is only recorded. Simulate it first.

Default rules for external people and agents

Rules for external people and AI agents that ask for more verification or refuse on risky signals. Without a stored policy they already apply to external people and agents, never to employees. With your own policy, add them to it here; you can then edit or remove them in the policy below.

Editing or removing a default rule weakens the protection of external people and agents. Simulate the policy before you save it.

Your policy has too many rules to add the missing default rules. Remove some rules first.

Where a revoked session also ends

When a risk decision ends a session, its end is sent to the Standard OIDC applications listed here (back-channel logout), to Shared Signals (SSF/CAEP) receivers and, when an account or password lock ends every session, to RADIUS clients that accept a Disconnect-Request and to live privileged sessions. Each delivery is tried at most eight times and audited.

AI novelty model

A second opinion for attack patterns nobody has labelled yet. It reviews phone approvals, transaction approvals, privileged access requests and session checks after the rules and the behaviour model have decided, and it only ever asks for more verification. It sees a fixed description of the request (new or known device and network, counts, history), never names, addresses or text. Shadow records only; active applies at a decision point once its calibration gate has passed there.

Time of day

On by default. The service learns each person's usual hours (48 buckets: weekday or weekend, by hour), stored like known devices and networks and kept for 90 days, and the behaviour model reads whether an hour is rare for that person. While a person's history is still being learnt, the hour never raises the risk. Turning it off deletes what was learnt.

Per-person history

On by default. The administrator burst rule reads each person's sensitive administrative actions in the last hour, and the service keeps, per person and hour, only the number of those actions, for 90 days. The peer comparison also keeps, for each administrative action, twelve counts (the person's and the other administrators' recent actions and usual rates), for 90 days. Numbers only, never names, addresses or text. Missing history never makes the burst rule fire, and the peer comparison stays quiet while the organisation is still learning. Turning it off deletes what was kept at once and turns both off.

The burst rule never refuses on its own: it asks for the chosen verification when an administrator's sensitive actions in the last hour reach both the minimum and the multiple of their own usual rate. While a person's usual rate is still being learnt (fewer than 8 active hours on 5 days), it only records a note.

A model learnt each night from this organisation's administrators flags an administrator whose activity is unusual for the group, for example a burst while no other administrator is busy. It asks for the same verification as the burst rule, once when both fire, about 2 times per administrator per month, and never refuses on its own. It needs at least 2 administrators and 256 administrative actions over 14 days; until then it only learns.

Simulate a response policy

Paste a candidate risk response policy (authguard.risk-policy.v2). It is replayed over the stored assessments; nothing is saved and no decision changes.