Risk score configuration

The Risk Score Configuration page lets administrators tune how OpenIAM computes risk. Risk is calculated by the Risk Manager service and rolls up through three levels — entitlement risk floors membership risk, which rolls up into identity risk — and each score lands on a 0–100 scale. This configuration is global: a risk score means the same thing everywhere it is consumed, including risk-driven access certification. Access it in the Webconsole at Administration > Risk Score Configuration.

The screen is split into two editable areas — the aggregation policy and the factor library — with a live score preview that recomputes a sample subject's band and per-factor breakdown as you make changes.

Aggregation policy

The aggregation policy is a single global row that turns a raw 0–100 score into a discrete band and applies a breadth-based uplift.

Band thresholds

Three ascending thresholds classify every score into one of four bands:

The thresholds are edited with sliders over a live band ruler. They are always kept strictly ascending (medium < high < critical); moving one threshold past another pushes the neighbouring thresholds out of the way. The seeded defaults are medium 25, high 50, critical 75.

Breadth uplift

Two parameters raise a subject's aggregate score according to the breadth of its access:

• Breadth uplift weight — how strongly access breadth increases the aggregated score.
• Breadth uplift cap — the maximum number of points breadth may add, regardless of the weight.

Context uplift cap

Each grant starts at the entitlement's own risk score. The circumstances of the grant — how it was assigned and how long it has been held — can raise that score but never lower it, and the context uplift cap sets the most those circumstances can add. A low cap keeps scores close to each entitlement's inherent risk; a high cap lets a poorly governed or long-unreviewed grant escalate further. The default is 40 points.

Factor library

A risk factor is a scoring strategy that contributes to a subject's score at one level. Factors are grouped in the library by the level they apply at — Entitlement, Membership, or Identity. OpenIAM ships with a set of built-in factors, enabled out of the box so scoring works with no configuration. Every number these factors use is on this screen: built-in values exist only as one-time starting defaults, and from then on scoring reads exactly what you see and save here.

Risk is scored for role and group entitlements and the memberships that grant them; direct user-to-resource grants are not scored.

Beyond the data the built-in factors read, OpenIAM also collects a per-identity behavioural risk score — how unusual an identity's recent activity is compared with its own history. It is exposed to the risk model as an identity-level selector for future custom factors; none of the built-in factors consumes it yet.

Configuring a factor

Each factor row exposes the following settings:

• Enabled — a toggle that includes or excludes the factor from scoring. Disabled factors contribute nothing and appear dimmed.
• Weight — a slider from 0.0 to 1.0 controlling the factor's relative weight within its level.
• Decay — how the factor's contribution fades over time once its triggering signal is in the past:
  • None — the contribution persists until a certification clears it.
  • Timed — the contribution fades linearly over a configurable decay window (in days).
• Audit — each row shows when it was last changed (Updated At) and the display name of the editor (Updated By).
• Parameters — some built-in factors expose tunable scoring parameters in their expandable detail (see below).

Built-in factors ship with a fixed identity and cannot be deleted or renamed; only their weight, decay, enabled state and parameters are tunable.

Factor parameters

Several built-in factors expose the constants that drive their scoring as editable parameters, so you can tune how a factor scores without a code change. Each parameter is a typed numeric input in the factor's expandable detail, pre-filled with the factor's default and constrained to a valid range; leaving it at the default preserves the shipped behaviour.

Alongside each parameter's value you can also set its min and max — the range the value is allowed to take. These bounds narrow the parameter's built-in hard limits: you can tighten the allowed range but not widen it beyond what the factor supports, and an out-of-range or inverted range is rejected on save. Leaving a bound empty falls back to the parameter's hard limit.

Parameter values are validated on save (each must be numeric and within its range) and take effect on the next score computation.

Metadata-driven score lists

The Membership Origin and Entitlement Sensitivity factors build their parameter lists dynamically from metadata types, so customer-defined vocabularies participate in risk scoring without a code change:

• Membership Origin lists every metadata type in the Membership tag grouping, one 0–100 score per tag, each row labelled with the tag's display name — see Membership tags for what each system tag means and how it is stamped. The shipped defaults order the built-in grant paths by how much governance stands behind them: Admin assignment (a direct webconsole or API assignment, which bypasses request and approval) defaults to 75, Admin or Owner system access to 60, Requested access (requested and approved through SelfService) to 25, and Birth right assignment (granted by a business rule) to 10. Customer-defined tags default to 50, and the unknown origin score (default 50) applies when a membership carries no origin tag at all — not knowing how access arrived is itself a governance signal.
• Entitlement Sensitivity lists every metadata type in the Risk grouping (the levels assignable to roles and groups) plus the three resource risk levels. Default scores are inferred from the level's name — a level containing High defaults to 75, Medium to 50, Low to 25, anything else to 50 — and are seeded into the factor's configuration on first start. Scoring is strictly configuration-driven: a risk level with no saved score (for example, one created after initial setup that no one has scored yet) contributes nothing until an administrator saves a score for it, and an entitlement with no risk level assigned is likewise left unscored.

A metadata type created later automatically appears in the list with its default score (the tag catalog is cached briefly, so allow a few minutes before reopening the page). Every default can be overridden; the coloured dot next to each score shows which band that score falls into under the current aggregation policy, so the number reads as a risk level at a glance.

Decay behavior

Each factor's expandable detail has a Decay behavior panel where you choose how the factor's contribution fades over time — None (persists until a certification clears it), Timed, or Linear — and, for the timed and linear options, select a decay window from the preset day options.

Band editor

Band-shaped factors such as Stale Membership are tuned with a visual Band Editor instead of plain inputs. It plots each score band across the domain axis (membership age in days on the x-axis, score on the y-axis). Drag a vertical handle to move a band cutoff, and drag the top edge of a band to change its score. All drags are constrained to each parameter's hard range and keep the cutoffs in order, so the configuration always stays valid.

Score preview

The preview panel scores a sample subject under the current policy and factor settings, showing the resulting band and each factor's contribution. It updates as you adjust thresholds, weights, or decay, so you can see the effect of a change before saving. The preview is illustrative — the authoritative score is always computed by the Risk Manager service.

Saving

The aggregation policy and each factor are saved independently. Saving refreshes the Risk Manager configuration cache, so changes take effect without a restart.

A configuration change does not immediately re-score the population: stored scores catch up as subjects are recomputed — on access changes, sign-ins, and at the latest during the nightly sweep. How that recomputation works, and how it scales to large populations, is described in Risk score recomputation at scale.