> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authflame.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk scoring, risk levels, and recommended actions

> Understand AuthFlame's risk score, how it maps to risk levels, and how the recommended action is derived for each email check.

Every AuthFlame check returns a `summary` object that condenses the underlying signals into three fields you can act on directly: `risk_score`, `risk_level`, and `action`.

## The summary object

```json theme={null}
"summary": {
  "action": "ALLOW",
  "risk_score": 3,
  "risk_level": "low"
}
```

* **`risk_score`**: an integer from `0` (safe) to `100` (highest risk).
* **`risk_level`**: a coarse bucket derived from the score, one of `low`, `medium`, or `high`.
* **`action`**: the recommended enforcement decision, one of `ALLOW` or `BLOCK`.

## Risk levels

| `risk_level` | Typical score range | What it usually means                                          |
| ------------ | ------------------- | -------------------------------------------------------------- |
| `low`        | 0–29                | Well-formed address on a reputable domain with no red flags.   |
| `medium`     | 30–69               | Mixed signals: for example, a free provider plus high entropy. |
| `high`       | 70–100              | Strong disposable, MX, or entropy signals against the address. |

<Note>
  Exact thresholds can shift as AuthFlame updates its models. Prefer branching on `summary.action` unless you need fine-grained control.
</Note>

## Recommended actions

`summary.action` is AuthFlame's opinion about what your signup flow should do.

* **`ALLOW`**: proceed with account creation.

* **`BLOCK`**: reject the signup. Show a generic error so you don't leak which signal tripped.

## Rolling your own thresholds

If you need custom behavior (for example, blocking anything above `85` on a free-trial signup) branch on `summary.risk_score` directly and ignore `action`. The score is stable across time for the same input signals, so it's safe to use in your own rules engine.