Risk Policies

Risk Policies help identify anomalous access and restrict high-risk operations. You can manually restrict specific IP addresses or create automated policies. When the same IP address or account enters incorrect passwords or verification codes multiple times within a defined period, the system automatically creates the corresponding restriction record.

Path: Sign in to the RootAuth Console, select the target application, then go to Configuration > Security Settings > Risk Policies.

 

1. Overview

Risk Policies include three tabs. All settings apply only to the current application:

Tab	Applies to	Purpose
IP Blacklist	IP addresses	Manually add IP addresses to restrict, or view IP restriction records created when a policy is matched.
Account Restrictions	Accounts	View records created by account-based policies and remove a record after confirming that the risk has been resolved.
Policy Management	IP addresses or accounts	Create and maintain automated detection rules. When a policy is matched, it automatically creates an IP blacklist or account restriction record.

Note: The Added by matched policy indicator in IP Blacklist and Account Restrictions means that the record was generated automatically. Both manually managed IP blacklist entries and policy-generated records can be deleted. Deleting a record removes the corresponding restriction immediately.

 

2. IP Blacklist

IP Blacklist restricts registration, sign-in, or password-reset operations from specific source IP addresses. In addition to manually added entries, a matched IP-based policy automatically creates a record here.

2.1 View and Search Records

On the IP Blacklist tab, use the search field to locate a record by IP address. The list shows the restriction type, creation time, expiration time, update time, and available actions. Records generated by a policy also display their match source.

When a record reaches its expiration time, it is marked as Expired and no longer restricts access. If the same policy is matched again, the system updates the record and recalculates its effective period.

 

2.2 Manually Add an IP Restriction

1. Click Add IP in the upper-right corner.
2. Enter the IP address to restrict, then select the operations to block and the effective duration.
3. Confirm the details and save. The restriction takes effect immediately.

This option is suitable for confirmed abnormal sources, such as IP addresses that repeatedly attempt brute-force attacks or bulk registration. To remove a restriction, find the IP address in the list and click Delete.

 

2.3 Remove an IP Restriction

When an IP address has returned to normal operation or its restriction needs to end early, remove the restriction from the IP Blacklist list:

1. Use search to find the target IP record.
2. Click Delete on the right side of the record.
3. Confirm the deletion in the confirmation dialog.

Deleting the record removes the current IP restriction immediately. For a record created by a matched policy, deleting the record does not delete the policy that triggered it. If the IP address meets the policy conditions again, the system creates a new restriction record. To stop automated restrictions, adjust or delete the relevant policy in Policy Management.

3. Account Restrictions

Account Restrictions displays records created by account-based policies. You cannot manually add an account restriction on this page. When an account meets a policy condition, the system automatically restricts its sign-in or password-reset operations.

3.1 View Restricted Accounts

The list shows the account identifier, restriction type, creation time, expiration time, and update time. Use filters to find an account by email address, phone number, username, or user ID. Expand a record to view its identity information.

3.2 Remove an Account Restriction

After confirming that an account has returned to normal operation, click Delete on the right side of the record and confirm to remove the restriction created by the risk policy. Removing a risk restriction does not affect the account's existing manual disablement status or other independent restrictions.

Important: Account Restrictions and disabled users are two different states. An account can have both at the same time. Removing an account restriction does not re-enable a manually disabled user.

 

4. Policy Management

Policy Management defines conditions for automated restrictions. When password errors or verification-code errors reach the threshold during the statistical period, the system automatically creates an IP blacklist or account restriction record.

4.1 Create a Policy

1. Go to the Policy Management tab and click Add Policy.
2. Select a statistical dimension: Same IP Address or Same Account.
3. Set the statistical period, error threshold, restriction types, and expiration time.
4. Confirm and save. The policy takes effect immediately.

 

4.2 Configure Restrictions by Dimension

Statistical Dimension	Record Created When Matched	Operations That Can Be Restricted
Same IP Address	IP Blacklist	Registration, sign-in, and password reset. You can select one or more operations.
Same Account	Account Restrictions	Sign-in and password reset. You can select one or more operations; registration cannot be restricted.

The statistical events are fixed as password errors or verification-code errors. The two error types are counted together. When either type reaches the threshold within the statistical period, the policy is matched.

 

4.3 Configuration Recommendations

Setting	Default Value	Allowed Range
Statistical Period	60 minutes	1-60 minutes
Error Threshold	6 attempts	1-100 attempts
Expiration Time	60 minutes	1-1440 minutes

Start with the default values and adjust them gradually according to your business's sign-in frequency and abnormal activity. If you create multiple policies, avoid using very similar conditions for the same restriction type, so that you can clearly identify the source and effect of each restriction.

 

4.4 Manage Existing Policies

The policy list shows the policy ID, object, restriction types, condition summary, expiration time, and creation time. You can delete policies that are no longer needed. Deleting a policy does not automatically remove IP blacklist or account restriction records that were matched previously. To remove a restriction immediately, delete the specific record from its corresponding tab.

5. What to Do After a Policy Match

1. Review the records with the matched-policy indicator in IP Blacklist or Account Restrictions, and confirm the restricted object and restriction type.
2. Use user activity logs and business context to determine whether the behavior is legitimate.
3. After the risk is resolved, delete the corresponding record to restore access. If needed, then adjust or delete the policy that created the record.

Priority Note: Policies automatically identify risk and create restriction records. The effective restriction is determined by valid records in IP Blacklist or Account Restrictions. Test carefully to avoid restricting the IP address or administrator account you are currently using.