---
title: "Risk Model"
slug: "risk-model-v6-7"
description: "Explore risk-based access control using user risk scores to manage entitlements and enhance security with multi-factor authentication."
updated: 2026-03-13T20:58:45Z
published: 2026-04-03T16:41:11Z
canonical: "support.appgate.com/risk-model-v6-7"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk Model

> [!NOTE]
> NOTE
> 
> Risk Model has been deprecated. However, you can still use risk scores for access control.

[Risk based access](/v1/docs/access-control-modes-v6-7) is a way to set up access controls based on a user risk score (provided as a claim) which in turn will decide if the action(s) specified in the entitlement are to be allowed. For example, access may only be allowed if the user risk score is medium or low. When the risk score is high then the entitlement will be denied (block rule applies). If a [user interaction](/v1/docs/applying-access-controls-user-interactions-v6-7) has been configured in the risk matrix, this will provide a way for the user to unblock access by performing some sort of additional authentication.

## Before you start

Pre-configure the following elements:

- ***MFA Provider***. For multi-factor user interactions, refer to [MFA Providers](/v1/docs/mfa-providers-v6-7)
- ***Identity Provider***. For password user interactions, refer to [Identity Providers](/v1/docs/identity-providers-v6-7)
- [***User Risk Claim***](/v1/docs/applying-access-controls-v6-7). Refer to [User claims](/v1/docs/user-claims-v6-7) and [Device claims](/v1/docs/device-claims-v6-7)
- If you plan to use the ***risk score claim*** provided by the Appgate ZTP Risk Engine, then you will need to [link your instance to ZTP](/v1/docs/ztp-settings-v6-7) and obtain a f[eature license for the Risk Engine](/v1/docs/licenses-v6-7).

Background information:

- The topic [access control models](/v1/docs/access-control-modes-v6-7#risk-based-access) explores the use of risk based access in more detail.
- Learn more about how to use [user interactions](/v1/docs/applying-access-controls-user-interactions-v6-7).
- Setting up [MFA Providers](/v1/docs/sys-config-multi-factor-authentication-v6-7) for user interactions.

Use the **Risk Model** page for:

- Defining the risk matrix which for controlling when entitlements will be allowed by the Gateway.
- Adding user interactions when the risk matrix shows USER ACTION, such as entering a valid multi-factor authentication.
- Adding a message to provide feedback to the user when the risk matrix shows DENY.

For details on configuration, refer to [configuring the risk model](/v1/docs/configure-the-risk-model-v6-7)