> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/risk.md). # Risk management Risk scoring in OpenIAM — what a score is, every factor and policy field explained for administrators, how certification uses it, and how reviewers should read it. OpenIAM gives every role and group, every grant of one to a person, and every person a **risk score** from 0 to 100. Certification campaigns use it to decide who and what to review, automation rules use it to approve routine grants, and reviewers use it to decide where to look first. This section explains all of it, for the people who configure it and the people who see it. ## Start here | If you are… | Read | | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Anyone who has just heard of risk scoring | [Risk management overview](/administration-guide/risk/overview.md) — what a score is, how it is made, where it appears, what it is not. No settings | | An administrator tuning the factors | [Risk factor reference](/administration-guide/risk/factors.md) — the three subject levels, then every built-in factor with its settings and an example | | An administrator tuning how factors combine | [Risk policies](/administration-guide/risk/policies.md) — weights, band thresholds, the Soft and Balanced strategies, toxic factors, Fine-tuning, a starting configuration | | A campaign or compliance owner | [Access certification and risk](/administration-guide/risk/certification.md) — the Risk tab, the membership risk threshold, the automation rule, auto-certified items | | A reviewer with a queue | [Reading risk on the reviewer screen](/administration-guide/risk/reviewer-experience.md) — the counts, the pill, the plain-language explanation, and a way to work the queue | Two files in this folder are not articles. `anchors.json` maps product UI elements to the sections here and is a build input for the frontend, so editing it is a product change; see the note at the top of this file. `_OPEN-QUESTIONS.md` lists what could not be confirmed when these pages were written. ## The example that runs through every page The same four names appear on every page, and their numbers agree from one page to the next. * **Maria Rossi** — a Finance analyst, three years in the company, stable access. Her identity score is 37 (Medium) and her `Finance-Reports-Read` membership scores 37. * **Tom Becker** — a contractor in Engineering on a 60-day contract, with broad access granted outside the normal process. His identity score is 99 (Critical), his `Payments-Admin` membership 98 and his `Finance-Reports-Read` membership 38. * **`Payments-Admin`** — an entitlement in the payments application that can move money. Its risk level is Critical and its entitlement score is 90. * **`Finance-Reports-Read`** — a reporting entitlement that can only open a dashboard. Its risk level is Low and its entitlement score is 25. All numbers use the shipped configuration: band thresholds 25 / 50 / 75, the Soft strategy, every factor enabled at weight 1.0. ## Glossary | Term | Meaning | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Risk score | A number from 0 to 100 saying how much attention a subject deserves. A ranking, not a decision | | Band | The name given to a range of scores: Low, Medium, High or Critical. Where each begins is set on the policy | | Subject level | The kind of thing a score is attached to: an entitlement, a membership or an identity | | Entitlement | A role or group. Its score describes how dangerous it is in anyone's hands | | Membership | One person's grant of one entitlement. Its score adds the context of that grant to the entitlement's score | | Identity | A person. Their score starts from their riskiest membership | | Factor | A rule that turns one kind of fact into a score from 0 to 100 for one subject level. Eight ship with the product | | Factor catalogue | The screen listing every factor the product knows, whether or not a policy uses it (**Administration → Risk factor configuration**) | | Risk policy | The object that decides which factors count, their weights, how they combine and where the bands begin. One ships, **Membership scoring policy**, and it governs all three levels (**Administration → Risk policies**) | | Weight | A factor's share of the average at its level, relative to the other factors' weights. From 0 to 1; weights do not need to sum to 1 | | Aggregation policy | The card on the policy that holds the band thresholds; the fixed arithmetic that combines factors | | Scoring strategy | The card on the policy that decides how strongly one alarming factor may drive a grant's score: Soft or Balanced | | Toxic factor | A factor whose score on a given grant is at or above the toxic cutoff. Decided grant by grant, not a property of the factor | | Escalation | The strategy mechanism that anchors a grant's score at its worst toxic factor once enough factors are toxic. Only ever raises a score | | Toxic cutoff | The factor score at or above which a factor counts as toxic. Follows the High threshold unless set explicitly in the Fine-tuning block | | Context uplift | The points the membership factors add above the entitlement's score, limited by the context uplift cap | | Breadth uplift | The points added to an identity score for each high-risk membership, limited by the breadth uplift cap | | Entitlement base | The entitlement's own score, shown as the first line of a membership breakdown | | Membership risk score | The one filter on a certification's Risk tab. Inclusive: a grant at or above the number is reviewed | | Auto-certified | A grant the campaign's automation rule approved at launch, without a reviewer, because its membership score was at or below the maximum score | | Drift | A change of band between a campaign's launch and now, shown as an arrow on the reviewer screen | | Recalculation | Re-scoring subjects after a configuration change: on demand after a save, or nightly | *Applies to OpenIAM 2026.9.1. Last reviewed 4 September 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/risk.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.