Decide who gets in, from where, and with what proof

Write rules that allow, ask for MFA, block or notify. Limit networks by address range. Score each sign-in by named risk signals. Try every rule in report-only mode first and see what it would have done.

Book a demo See the order of checks

Access rule · Admins off-networkDry run

Whenrole is admin

Andthe address is unknown

Thenask for MFA

Priority10

Dry run: this sign-in would be asked for MFA. Nothing was refused.

Why it matters

Layers you can see, test and trust

Report-only first

Every rule is evaluated and counted before it refuses anyone, and a dry run shows its answer for any sign-in.

Simple layers, strong together

Lockout, rate limits, the bot check, networks, rules and risk each do one job.

Named signals, not a black box

A risk band comes with the signals behind it, so you know why someone was asked for more.

How it works

The order of checks on every sign-in

1DoorLockout and rate limits5 failures in 15 minutes locks for 15 minutes; per-address limits on every door.
2DoorBot checkThe first-party CAPTCHA, in observe or enforce mode per surface.
3NetworkNetwork policyConsole, then organization, then application. Any matching deny wins.
4RulesConditional accessFirst matching rule by priority: allow, MFA, block or notify.
5RiskRisk bandNormal, extra verification or high risk, from named signals.
6OutcomeProceed, step up or refuseEvery decision is written to the audit trail.

Capabilities

What each layer can do

Layer	How it works	Status
Conditional access rules	Conditions: roles, people, email domains, time zones, IP ranges, weekdays, hours, unknown address, new device. Actions: allow, MFA, block, notify. Dry run any rule.	Live
Enforcing access rules	Refusals and MFA demands applied to live sign-ins, per door.	Early access
Network policy	Allow and deny address ranges at console, organization and application scope; up to 64 ranges a rule, 50 rules a scope; an SDK evaluate call.	Live
Enforcing network policy	Refusing sign-ins outside the policy.	Early access
Risk evaluation	Bands from live signals: unknown client address, recent failed attempts, refresh-token reuse, a denied push. High risk needs two signals from two groups.	Early access
Approximate location	City, region and country on sessions and approvals from an offline database, for display.	Early access
Account lockout	Attempts, window and duration per organization; an organization can only tighten.	Live
Rate limits	Per address: sign-in 10, sign-up 5, reset 5, MFA verify 10 a minute.	Live
Sessions	List and revoke one, revoke the others, sign out everywhere; admins can force sign-out.	Live
Signing keys	Rotation with a notice window and webhook events to app owners.	Live

Configuration

What admins set

Option	Values	Default
Access rule	name, conditions, action (allow, mfa, block, notify), priority, active	mfa · 100
Network rule	allow or deny, up to 64 address ranges, label	none
Lockout	attempts 2 to 20 · window 1 minute to 24 hours · duration 1 minute to 7 days	5 · 15 min · 15 min
Password policy	Length, character classes, history, rotation	8 characters
Session timeout	Idle timeout; optional absolute cap	30 minutes

Under the hood

What protects it

From the code

api/sso.pya rule, as the API takes it

class _AccessRulePayload(BaseModel):
    name: str
    description: str | None = None
    conditions: dict = Field(default_factory=dict)
    action: str = "mfa"  # allow | mfa | block | notify
    priority: int = 100
    is_active: bool | None = None

# example body
{"name": "Admins off-network", "action": "mfa",
 "priority": 10, "conditions": {
   "roles_any": ["admin"], "unknown_ip": true}}

Security notes

An address that cannot be resolved is treated as indeterminate, and refused under enforcement.
Locations are shown as approximate and are not used for decisions today.
Account locks and unlocks are sent as webhooks to subscribing apps.
Known-bad passwords are refused when people choose them on the console.

Works with

Part of one platform

CAPTCHA The bot check in front.Passkeys & MFA What "ask for MFA" asks for.Audit & SIEM export Every decision, exportable.

Which plans include it, and the limits that apply, are on the plans page.See plans →

Make every sign-in harder to fake

Write your first rule, dry-run it, and switch it on when you trust it.

Book a demo Start free trial