Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.
Overview
MANDATE assigns every verified browser session a bounded risk score from 0.0 (higher risk) to 1.0 (lower risk). The score summarizes browser-session evidence; it does not identify a definite bot or prove a human operator. For production browser traffic, route authority comes from hosted live Gate validation of the server-issued cookie and request proof; local SDK verification can read the score from ordinary compatibility X-Mndt tokens. Hosted validation returns decision fields and refreshed tokens only; raw scores stay internal.
An issued token's score does not mutate in place. Follow-up encrypted deltas and hosted validation can return refreshed opaque tokens with updated lineage, marker, route context, and TTL. Ordinary tokens use the default 15-minute lifetime; route-scoped hosted validation can return shorter low/mid/high tokens for sensitive actions.
Score Range
| Segment | Score Range |
|---|---|
| Lower-risk evidence | 0.85 - 1.0 |
| Moderate confidence | 0.5 - 0.85 |
| Suspicious | 0.2 - 0.5 |
| Likely automated | 0.0 - 0.2 |
Your distribution will vary based on your traffic profile.
Configuring Thresholds
Configure score thresholds in the dashboard under Policies for the selected site key.
You can set thresholds for each action:
| Action | Default Threshold |
|---|---|
allow | score ≥ 0.5 |
challenge | 0.3 – 0.5 |
block | score < 0.3 |
Persisted thresholds must keep the block cutoff at or above 0.20, the allow cutoff at or above 0.40, and block cutoff < allow cutoff. Unsafe values are ignored by the gate and safe defaults are used for the decision.
Tips for Tuning
Tip
Start permissive, then tighten. Begin with default thresholds and monitor your block rate. Tighten only after you understand your traffic.
Reducing false positives
If legitimate users are getting blocked:
- Check if they use privacy-focused browsers (Brave, Tor) that may reduce signal availability
- Lower the allow threshold temporarily
- Use the "challenge" action instead of "block" for borderline cases
- Review blocked sessions in the dashboard to identify patterns
Reducing false negatives
If bots are getting through:
- Raise the allow threshold (e.g., 0.85)
- Apply a stricter policy preset in Policies
Per-endpoint tuning
Different endpoints have different risk profiles:
// Payment endpoints: very strict
if (req.path.startsWith('/api/payment') && result.score < 0.9) {
return deny();
}
// Content read: permissive
if (req.path.startsWith('/api/content') && result.score < 0.4) {
return deny();
}Dashboard Signals
The Signals and Activity pages show:
- Score histogram — distribution of scores over time
- Decision trends — allowed, challenged, and blocked traffic over time
- Endpoint pressure — route-level decision mix
Access score distribution and endpoint pressure in Signals, and per-request score detail in Activity.