Risk-based access adapts access decisions or controls to the assessed risk of the identity, resource, requested action and context. Higher risk may require stronger authentication, additional approval, shorter duration, closer monitoring or denial.
Risk-based access should use explainable factors, documented thresholds and an exception process. It should not create opaque or discriminatory decisions.