| Rule | When | Then | Hits · 7 d | Status | |
|---|---|---|---|---|---|
| AD-01 | Impossible travel (speed > 900 km/h, no corporate VPN) | Block and revoke all sessions | 6 | Active | |
| AD-02 | New device and new country | Step-up with passkey | 212 | Active | |
| AD-03 | Leaked password match | Force reset, revoke tokens | 9 | Active | |
| AD-04 | Sign-in from hosting or Tor network | Deny for workforce; challenge for RO users | 1,904 | Active | |
| AD-05 | Behaviour score below 0.4 (typing, navigation) | Step-up | 58 | Active |
R_id = 1 − Π (1 − p_k) # noisy-OR over independent signals p_travel = 0.9 if speed > 900 km/h else 0 p_leak = 0.8 if password in breach corpus p_network = 0.6 Tor · 0.4 hosting · 0.1 residential p_behaviour= 1 − behaviour similarity step-up if R_id ≥ 0.5 · deny if R_id ≥ 0.8