Policy Engine
HCS is a score, not a decision. Call GET /v1/session/:id?critical=true before a high-stakes action, and the policy engine maps the score plus that critical flag to a BotAction — what actually happens. See Policy Rules for how to use this.
AllowLet the request through normally. Used for high-HCS sessions.
SilentTarpitDeliberately slow the response without telling the caller — wastes an automated attacker's time without alerting them.
StepUpChallengeAsk for additional verification (WebAuthn) before proceeding. For borderline HCS scores on critical actions.
HoneypotRedirectRoute the request to a decoy flow that looks real but does nothing — useful for observing attacker behavior safely.
RateLimitDrop the session's request rate to a fixed ceiling via Redis. Applied alongside the primary action, not instead of it.
TerminateSessionEnd the session immediately by revoking it. Used for confidently synthetic traffic attempting a critical action.
Example configuration
{
"min_hcs": 0.30,
"max_hcs": 0.35,
"action": "StepUpChallenge",
"tarpit_delay_ms": null
}