Risk score grading
Risk score grading defines how OneView translates a triggered rule action into a score between 0 and 100. It is a default Transaction Monitoring page and does not require the Rules Sub-module. Viewing requires Read transaction settings, while saving changes requires Manage transaction settings.
Open Transaction Monitoring → Risk Score Grading.
Default ranges
| Decision | Range | Result |
|---|---|---|
| PASS | 0 to 34 | No live rule requires intervention. |
| FLAG | 35 to 49 | The transaction proceeds and is marked for review. |
| HOLD | 50 to 74 | The transaction is held for an analyst decision. |
| BLOCK | 75 to 100 | The transaction is rejected by the triggered control. |
OneView creates this default policy automatically when the module is installed. Transaction administrators may change where FLAG, HOLD, and BLOCK begin.
How boundaries behave
The ranges always cover every whole number from 0 through 100 without overlaps or gaps. Moving a starting boundary automatically changes the end of the range before it. For example, changing FLAG starts at from 35 to 40 changes PASS to 0 through 39.
Each starting value must remain greater than the one before it:
- FLAG must start above 0.
- HOLD must start above FLAG.
- BLOCK must start above HOLD and cannot exceed 100.
How a transaction receives its score
Rules select actions, not points. When multiple live rules fire, OneView chooses the most severe action in this order: BLOCK, HOLD, FLAG. The transaction receives the starting score of that action's current range.
With the default policy:
- One or more FLAG rules produce FLAG with a score of 35.
- A HOLD rule produces HOLD with a score of 50, even if FLAG rules also fired.
- A BLOCK rule produces BLOCK with a score of 75, even if FLAG or HOLD rules also fired.
- No triggered live rule produces PASS with a score of 0.
Multiple rules in the same action do not accumulate points or promote the transaction to another action. They remain visible as separate evidence for the analyst.
Version history
Every save creates a new grading version. New transactions use the latest version. Existing transaction records keep the ruleset snapshot and grading version used when they were evaluated, so an earlier decision remains explainable after the ranges change.
Grading versions are append-only. Once a version has evaluated a transaction, its boundaries cannot be edited or deleted. A grading change always creates a new version and never changes a historical decision.
The transaction's Decision & review tab displays this grading version alongside the assigned risk score.