Adaptive access weighs identity trust and access risk continuously — at sign-in, and again every time a signal says something changed. At Monokee the policy doing the weighing is a flow you can open and read, not a score returned by something nobody is allowed to look inside.
Adaptive access exists because the assumptions underneath a single login-time decision quietly stopped holding.
The token was issued at nine, when the laptop was patched, the network was the office and the person had just touched a passkey. None of that is still being checked at four in the afternoon, and none of it is necessarily still true. Access keeps being granted on the strength of a fact that expired hours ago.
The thing that should change the verdict is rarely produced by the identity provider. Device posture comes from endpoint management, the fraud score from an antifraud engine, the alert from the SOC, the breached password from a threat feed. Adaptive access is only as adaptive as the signals it is allowed to hear.
Most risk engines answer with a number and a verdict. Nobody outside the vendor can say which input moved, which rule fired, or why this user was interrupted and that one was not — and that is the exact question an auditor, a regulator or an annoyed executive will ask.
Monokee treats the third as the design problem. An access decision that cannot be read is a decision nobody can defend — not to an auditor, not to a regulator, and not to the person it just interrupted.
Adaptive access is an argument about evidence. These are the categories that change a verdict — and most of them are produced by systems you already run, which is why getting them to arrive matters more than the scoring logic that consumes them.
How the person proved who they were, and how long ago. A passkey touched two minutes ago and a password typed this morning are not the same evidence, and a policy that treats them as one is not adaptive — it is just late.
Managed or unmanaged, patched or drifting, attested by hardware or merely claimed by a user agent string. The device is the part of the session most likely to change while nobody is looking at it.
Address reputation, a corporate egress that suddenly is not one, a move between countries no journey could have made in the time available. Weak evidence on its own, useful the moment it disagrees with everything else.
What this account normally does, at what hours, from what clients, at what pace — and how far the session currently running sits from that shape.
A credential found in a breach dump, an alert raised by detection and response tooling, a token replayed somewhere it should not be. These systems learn first; the access layer is worth nothing here unless somebody tells it.
The same account, the same device and the same risk score justify very different answers depending on whether the request reads a directory entry or moves money. Risk without stakes is only half the input.
A control with two settings gets configured for the worst case and then relaxed until people stop complaining. A graded response is what makes it possible to be strict about the thing that matters without being strict about everything.
The overwhelming majority of the time nothing is wrong, and the correct adaptive response is to leave the person alone. Friction spent where it was not needed is friction unavailable where it is.
Keep the session and take away part of it: read but not export, view but not approve, the internal application but not the payment one. A smaller session is often the proportionate answer, and it is the one most deployments never implement because their access layer only knows how to allow or deny.
Step up to a stronger factor, and only for the action that warranted it. The user gets an interruption that visibly relates to what they just tried to do, which is the difference between a control people accept and one they route around.
Revoke the session now rather than declining to renew it later. The gap between those two is the window an attacker is working in, and it is measured in the lifetime of a token nobody re-examined.
Whichever one fires, the reason is recorded: which signal moved, which branch was taken, which policy version was in force. An adaptive decision you cannot explain afterwards is a liability wearing the costume of a control.
Trust is not a property the session keeps until it expires. It is a reading, and the reading moves while the session is still running.
Continuous, event-driven trust is an area the whole industry is still building out. Which signal sources a given deployment can consume today, and how quickly they arrive, is a conversation worth having with us rather than something to infer from a diagram.
Adaptive access attracts more roadmap than product. It is worth being explicit about which parts are available now and which are still arriving — for us and for everybody else selling into this market.
Raising assurance is a node on the canvas, attached to the application, the API or the single transaction that needs it — not a global setting that everybody pays for.
Lifetime, scope and conditions belong to the session itself, so it can be shortened, narrowed or ended without waiting for the application to ask a question again.
WebAuthn and FIDO2 give the top rung of the ladder something worth climbing to: a factor that a real-time phishing proxy cannot relay, because the signature is bound to the origin.
Identity, device, network and policy are evaluated together where access is granted, rather than each application keeping its own drifting copy of the rules.
Event-driven frameworks — CAEP for continuous access evaluation, RISC for risk and incident sharing — let one system tell another that something changed, in seconds rather than at the next login. This is where the industry is heading and where most products, ours included, are still building.
Long-lived entitlements are giving way to decisions issued for one session, or one action, and then gone. It removes the standing privilege an attacker inherits along with the account.
The branch that decides who gets asked for a second factor is drawn on the same canvas as the rest of the identity journey. You can see the condition, follow the path a session took, change the threshold and version the change.
That is the difference between adaptive access you can operate and adaptive access you can only trust. The people who own the rule — fraud, compliance, product — are the people who can read it, without asking anyone to interpret a score on their behalf.
We'll draw the policy that would have caught it, and tell you honestly which signals your environment can already feed it.
Talk to an expert