---
title: "Configure the Risk model"
slug: "configure-the-risk-model-v6-5"
description: "Map user risk scores to entitlement sensitivity with our Risk Model. Configure outcomes like DENY, USER ACTION, or ALLOW based on user risk and sensitivity."
updated: 2025-12-04T16:41:23Z
published: 2025-12-04T16:41:23Z
canonical: "support.appgate.com/configure-the-risk-model-v6-5"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the Risk model

Provides a way to map user risk scores to the sensitivity of Entitlements. You may wish to review the [Before you start](/v1/docs/risk-model). When you're ready to Configure the Risk model, complete the fields in the form.

## Risk Model

***User Risk Source***

Select the source of the user risk score to be used in the risk model. The Risk Model is designed for use with ZTP, however an externally computed claim value (Claims.user.agScripted.risk.score) can also be used. See [Access Control modes](/v1/docs/access-control-modes) for more details.

*User Claim Script*

Uses the User Claim Script result (claims.user.agScripted.risk.score) as the risk score.

*Rule Defined in ZTP*

Select the ZTP configured rule to be used for calculating the risk score.

***Configure Risk Matrix***

Click on the nine cells to select one of the three outcomes <DENY>, <USER ACTION> or <ALLOW>. Only one type of user action (pushed to the user's device) can be specified for the matrix. The outcome is derived from just two inputs sensitivity and user risk. Each of the cells can have its own outcome, but typically <DENY> is more likely to be used for high sensitivity hosts being accessed by high risk users, and <ALLOW> for low sensitivity low risk users.

*Sensitivity*

Sensitivity is set in Entitlements > Access Controls. When Risk Based Access is selected the outcome for each level of sensitivity (based on user risk) is defined by this matrix.

*User Risk*

User risk claim value will trigger the outcome defined in one of the three columns High (3), Medium (2) and Low (1).

*Matrix settings*

*Allow*

Permits use of the Entitlement(s).

*Deny*

Denies use of the Entitlement(s) .

*User Action*

Requires user to perform 'Require MFA' or 'Password' to permit use of the Entitlement(s). This will be using a pre-configured [IdP](/v1/docs/specific-settings) or [MFA](/v1/docs/configure-mfa-provider) provider.

***User Action Settings***

Only one type of pre-configured provider can be used for User Actions when using the Risk Model. Under the covers, this works in a similar way to the [user interactions defined within Conditions](/v1/docs/configure-conditions). When the access criteria is set (in a Condition) the time period is set to define how long user response claim remains valid. This is also the case for the Risk Model, but in order to simplify the task of configuration, the time period is preset to 240 minutes (4 hours). So a typical user will be asked to enter their OTP in the morning and again in the afternoon.

*Password*

Select the identity provider to be used for the User Action.

*Require MFA*

Select the MFA provider to be used for the User Action.

***User Messages***

Messages to be displayed to users for <USER ACTION> and <DENY> outcomes. There are two separate message fields provided one for each outcome.

Key-value pairs related to the identity and content of the user or device and are specific to each session.

A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system.