How scoring works

The short version. For the full walkthrough see How it learns.

Signals → weighted logit → sigmoid → 0–100

On each call we extract a set of signals (each with an intensity between 0 and 1), look up the current workspace weight for each, sum weight × intensity into a logit, subtract the user's trust prior, and squash the result through a sigmoid into a 0–100 risk score.

Decision thresholds

• ALLOW — riskScore < 35
• REVIEW — 35 to 59
• STEP_UP_AUTH — 60 to 79
• BLOCK — 80 or higher

Confidence

Confidence grows with the number of signals that fired and with how many of those signals have learned weights in your workspace. A fresh workspace returns lower confidence; one with a few weeks of feedback returns much higher confidence on the same call.

Feedback adjusts targets, not the whole model

When you label an event, only the signals that actually fired on that specific event have their weights moved — by an amount proportional to how much each one contributed. This is recorded in the event's signalContributions.