Risk Policy

The policy behind the scenes that decides what happens at each risk level — allow, flag, hold for review, or block. There is currently no dedicated admin screen for setting it; this page explains the concept and where its effect is visible instead.

How it works today

1. Every provisioning event gets a 0–100 score from the enabled signals on Provisioning Risk → Risk Rules (and any per-application overrides).
2. The score maps to a fixed LOW/MEDIUM/HIGH/CRITICAL band (≤30 / 31–60 / 61–85 / 86–100), and each band maps to an action — Allow, Flag, Hold, or Block — set at the tenant level.
3. Allow lets provisioning proceed normally. Hold pauses it for review — except for access requests, where a human approver already decided, so Hold is bypassed there and the decision is recorded instead (see the note below). Block refuses provisioning outright everywhere, including access requests.
4. The bands and per-level actions aren't editable from any current admin screen — they come from the tenant's seeded defaults. If you need to change them for a tenant, that currently requires a direct update to that tenant's risk policy record.