A Decision Strategy is a special type of Ruleset. It strictly runs last and represents the overall risk and decision assigned to the event.
It determines the logic that makes the final decision on what should occur with the event by using Rules that access all previous Features, Signals, Scores and Results.
Decision Strategy vs. normal Ruleset
- An event can only be assigned one Decision Strategy
- A Decision Strategy will execute last, strictly after everything else
- Decision Strategies have special fixed results, relating to the final decision on the overall treatment for the event
Decision Strategy Results
How the results are defined for particular risks and what is done for each is a design decision.
But some indication of best practice is provided.
| Result | Description |
| Pass | Event is considered Trusted. Should be passed through with no friction |
| Challenge | Event is likely good, but has enough risky signals that require additional automated authentication or step-up |
| Alert | Usually reserved for where an Event can be passed, but an Alert is sent out (whether that be to customer or operations team) in case the action was unexpected. |
| Review | Event is risky enough to warrant a manual review. The Event may be put on hold during this time. |
| Reject | Event is highest risk, when blocking action, terminating session or suspending account is advised. |