Sessions

Session Risk States

Beyond single decisions, QUORUM re-checks behaviour on every authenticated institutional request (continuous identity verification), so a session that drifts mid-way is caught.

Continuous Identity Verification

defaults

on each authenticated request:
    signals = X-Quorum-CIV-Signals header (from SDK)
    score   = compare with user's baseline
    score >= 82 -> 403 SESSION_IDENTITY_DRIFT
    score >= 55 -> allow + X-Quorum-CIV-Warning
    no signals from an established SDK user
                -> raised risk floor (45)

Thresholds

Warning and block thresholds are configurable; 55 and 82 are the defaults.

Absent signals

A client that normally sends behavioural signals and suddenly stops is treated as more suspicious than a new API-mode client.

Insider sandbox

A security_admin can route a flagged human console account to decoys for 1–168 hours; API traffic and decisions are never affected.

KB Analytical Solutions Inc. // Session Risk States // Describes QUORUM at code baseline e9c2cf7