Risk scoring, risk levels, and recommended actions - AuthFlame

Every AuthFlame check returns a summary object that condenses the underlying signals into three fields you can act on directly: risk_score, risk_level, and action.

The summary object

"summary": {
  "action": "ALLOW",
  "risk_score": 3,
  "risk_level": "low"
}

risk_score: an integer from 0 (safe) to 100 (highest risk).
risk_level: a coarse bucket derived from the score, one of low, medium, or high.
action: the recommended enforcement decision, one of ALLOW or BLOCK.

Risk levels

`risk_level`	Typical score range	What it usually means
`low`	0–29	Well-formed address on a reputable domain with no red flags.
`medium`	30–69	Mixed signals: for example, a free provider plus high entropy.
`high`	70–100	Strong disposable, MX, or entropy signals against the address.

Exact thresholds can shift as AuthFlame updates its models. Prefer branching on summary.action unless you need fine-grained control.

Recommended actions

summary.action is AuthFlame’s opinion about what your signup flow should do.

ALLOW: proceed with account creation.
BLOCK: reject the signup. Show a generic error so you don’t leak which signal tripped.

Rolling your own thresholds

If you need custom behavior (for example, blocking anything above 85 on a free-trial signup) branch on summary.risk_score directly and ignore action. The score is stable across time for the same input signals, so it’s safe to use in your own rules engine.

⌘I