Walk a step-up policy for sensitive actions

The risk transition A normal payroll session turns into a high-volume bank-detail export from a new device. The user may be legitimate, but the action risk has changed enough to require fresh proof. The framework Step up when action risk rises A session can be valid and still not strong enough for the next action. Step-up raises assurance at the moment risk changes. Use proportional friction: low-risk actions stay smooth, high-risk actions require fresh proof, stronger authenticator, or device assurance. Bad instinct One login authorizes every later action. The user experiences friction only when the requested action deserves it. 01…

Sign up free — one personalized lesson every day, matched to your role and goals.

Already have an account? Sign in