{
"slug": "continuous-authentication-vs-per-action-gating-actually-stops",
"topic_id": "TOPIC-089",
"cluster": "Remote Workforce & Insider Threat",
"tier": "Tier B",
"title": "Continuous authentication versus gating the actions that matter",
"summary": "One approach watches everyone all the time and produces probabilities. The other watches nobody and asks for proof at a small number of points.",
"lede": "Both promise that the person acting is the person authorised. They differ in what they collect, what they produce, and whether the answer is a score someone has to interpret.",
"date": "2024-11-07",
"category": "Comparison",
"author_id": "solene-beaumont-adjei",
"tags": [
"continuous authentication",
"step-up",
"comparison",
"privacy",
"account takeover",
"architecture"
],
"image_title": "Continuous Versus Per Action",
"schema": "Article",
"key_takeaways": [
"Continuous authentication produces a confidence score from observation; per-action gating produces a binary result from a challenge.",
"The score must be thresholded, and any threshold trades false positives against missed detections at a very low base rate.",
"Per-action gating collects nothing and covers only the actions it is applied to — which is its main limitation and also why it is deployable."
],
"body": [
{
"type": "h2",
"text": "Side by side"
},
{
"type": "diagram",
"kind": "compare",
"alt": "Two different outputs",
"caption": "One produces a probability that someone must act on. The other produces an artefact or refuses.",
"nodes": [],
"left": {
"title": "Continuous authentication",
"items": [
"Watches everyone, always",
"Output is a confidence score",
"Needs a threshold nobody can set",
"Degrades with fatigue and injury",
"Evidence: a model's opinion"
]
},
"right": {
"title": "Per-action gating",
"items": [
"Watches nobody",
"Output is a signature or a refusal",
"No threshold to tune",
"Unaffected by mood or hardware",
"Evidence: a verifiable artefact"
]
}
},
{
"type": "table",
"head": [
"Property",
"Continuous authentication",
"Per-action gating"
],
"rows": [
[
"Data collected",
"Behavioural telemetry, continuously",
"Nothing between actions"
],
[
"Output",
"A confidence score",
"Valid or invalid"
],
[
"Requires interpretation",
"Yes — a threshold and triage",
"No"
],
[
"Coverage",
"All activity",
"Only gated actions"
],
[
"User experience",
"Invisible until it flags you",
"A gesture at defined points"
],
[
"Failure mode",
"False positives at scale",
"An attacker uses an ungated path"
],
[
"Privacy and legal posture",
"Complex in many jurisdictions",
"Straightforward"
],
[
"Evidence produced",
"A score and a log",
"A verifiable signature"
]
]
},
{
"type": "p",
"html": "Two rows determine most of the decision: what is collected, and whether the output requires a human to interpret it."
},
{
"type": "h2",
"text": "The threshold problem"
},
{
"type": "p",
"html": "A continuous system outputs a number and someone must decide what number triggers an action. That decision cannot be avoided and has no good answer at a low base rate."
},
{
"type": "code",
"text": "Threshold too sensitive:\n hundreds of employees flagged for typing differently\n → alerts ignored, control becomes decorative\n\nThreshold too permissive:\n a competent impostor stays inside the band\n → nothing is detected\n\nBetween:\n both problems, proportionally"
},
{
"type": "p",
"html": "There is no setting that produces high precision when genuine impostors are a handful in ten thousand. That is arithmetic rather than a product limitation."
},
{
"type": "h2",
"text": "The honest weakness of gating"
},
{
"type": "p",
"html": "Coverage. It protects exactly the actions it is applied to, and an attacker who finds an ungated path takes it."
},
{
"type": "p",
"html": "This is a real limitation and it is manageable in a way the threshold problem is not, because it is an enumeration exercise. The set of irreversible actions in a system is finite and findable; the set of behaviours that indicate an impostor is not."
},
{
"type": "ul",
"items": [
"Money movement and changes to payment destinations",
"Permission and role changes",
"Bulk data access and export",
"Credential enrolment and recovery",
"Destructive operations and configuration of logging or retention"
]
},
{
"type": "p",
"html": "In most enterprise systems that is ten to thirty endpoints, discoverable in a day."
},
{
"type": "h2",
"text": "What the step-away case reveals"
},
{
"type": "p",
"html": "A common argument for continuous authentication: it notices when a user walks away and someone else sits down."
},
{
"type": "p",
"html": "In practice it notices this by detecting a behavioural change, which means it has the same precision problem — and a user who steps away and returns produces the same signal as a substitution."
},
{
"type": "p",
"html": "Per-action gating handles the scenario differently and more definitively. The person who sits down can browse. They cannot move money, because that requires a gesture on a credential they do not have."
},
{
"type": "h2",
"text": "Where continuous signals do belong"
},
{
"type": "p",
"html": "As an input to when a challenge is required, rather than as a detector."
},
{
"type": "code",
"text": "# The productive combination\n risk_signal = behavioural_model(session) # probabilistic\n\n if action in GATED_SET:\n require_signature() # always\n elif risk_signal > elevated:\n require_signature() # sometimes\n else:\n proceed()\n\n# The signal adjusts when proof is demanded.\n# It never accuses anyone, and it never decides alone."
},
{
"type": "p",
"html": "In this arrangement a false positive costs the user a few seconds rather than an investigation, which is the right cost for a signal of that precision."
},
{
"type": "h2",
"text": "Choosing between them"
},
{
"type": "table",
"head": [
"If your priority is",
"Choose"
],
"rows": [
[
"Preventing high-consequence unauthorised actions",
"Per-action gating"
],
[
"Evidence for an auditor or a claim",
"Per-action gating — it produces a verifiable artefact"
],
[
"Operating under strict employee monitoring law",
"Per-action gating — it collects nothing"
],
[
"Broad visibility into anomalous activity",
"Continuous signals, as input rather than verdict"
],
[
"Both",
"Gating on the enumerated set, signals to trigger additional challenges"
]
]
},
{
"type": "p",
"html": "The practical recommendation is the last row, with the order mattering: enumerate and gate first, then add signals. Deploying signals first produces alerts nobody can act on, and organisations that do it in that order tend to abandon both."
},
{
"type": "h2",
"text": "A worked comparison"
},
{
"type": "p",
"html": "Take one quarter in a 4,000-person organisation with roughly 90 payment-release, code-signing and privileged-access actions a day."
},
{
"type": "table",
"caption": "Same quarter, two approaches",
"head": [
"",
"Continuous",
"Gating"
],
"rows": [
[
"Events generated",
"~11,000 anomaly alerts",
"~8,100 signature prompts"
],
[
"Investigated by a human",
"A sampled fraction",
"None — the user signs or does not"
],
[
"Blocked at the moment of effect",
"Nothing; alerts are after the fact",
"Every unsigned action"
],
[
"Evidence at dispute",
"A score and a model version",
"A signature over the rendered effect"
],
[
"False positives on a wrist injury",
"Sustained, for weeks",
"Zero"
]
]
},
{
"type": "p",
"html": "Those counts are illustrative, but the shape is not: one approach generates work proportional to headcount, the other generates work proportional to consequential actions — a much smaller number that does not grow when someone changes keyboards."
},
{
"type": "h2",
"text": "Objections and honest limits"
},
{
"type": "p",
"html": "“Gating misses everything between the gates.” It does, and this is the real weakness. The answer is not to lower the bar but to choose gates that sit where loss is realised — payment release, privileged escalation, bulk export, code signing."
},
{
"type": "p",
"html": "“Continuous signals must be worth something.” They are, for routing and for investigation after the fact. They are a poor basis for blocking, because blocking on a probability means blocking tired people."
}
],
"faq": [
{
"q": "Why is thresholding unavoidable for continuous authentication?",
"a": "It outputs a score, so someone must set a trigger point. At a very low base rate no setting produces high precision."
},
{
"q": "What is per-action gating's real weakness?",
"a": "Coverage — it protects only the actions it is applied to. That is manageable because the set of irreversible actions is finite and enumerable."
},
{
"q": "What about someone sitting down at an unattended machine?",
"a": "They can browse. They cannot move money, because that requires a gesture on a credential they do not have."
},
{
"q": "Should behavioural signals be used at all?",
"a": "Yes, as an input deciding when to demand proof. A false positive then costs seconds rather than an investigation."
},
{
"q": "Is continuous authentication useless?",
"a": "No. It is useful for routing and post-hoc investigation. It is a poor basis for blocking, because the score has to be thresholded and every threshold is wrong somewhere."
},
{
"q": "How many gates is the right number?",
"a": "Few enough that a typical person meets one a handful of times a week. More than that and the gates are on the wrong actions."
},
{
"q": "Does gating leave gaps?",
"a": "Yes, by design. Everything between gates is ungated, which is why gate placement is the whole exercise."
}
],
"sources": [
{
"t": "NIST SP 800-63B — Authentication and authenticator management",
"u": "https://pages.nist.gov/800-63-4/sp800-63b.html"
},
{
"t": "EDPB guidelines and opinions on data protection at work",
"u": "https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en"
},
{
"t": "W3C Web Authentication: An API for accessing Public Key Credentials Level 3",
"u": "https://www.w3.org/TR/webauthn-3/"
},
{
"t": "NIST SP 800-63B — Authentication and Lifecycle Management",
"u": "https://pages.nist.gov/800-63-3/sp800-63b.html"
}
],
"related": [
{
"slug": "keystroke-dynamics-behavioral-biometrics-fail-against-remote",
"title": "Why behavioural biometrics fail",
"category": "Future of Work"
},
{
"slug": "session-hijacking-via-infostealers-mfa-login-protect-post",
"title": "Why MFA at login does not protect post-login actions",
"category": "Developer"
},
{
"slug": "zero-biometric-workforce-assurance-model-verifying-identity",
"title": "Workforce assurance without biometric collection",
"category": "Future of Work"
}
],
"image": "https://cdn.twc.sh/images/igcache/Continuous%20Versus%20Per%20Action/1200_630/blog.jpg",
"wordcount": 993,
"url": "/blog/continuous-authentication-vs-per-action-gating-actually-stops.html",
"reading_time": "4 min read",
"seo_title": "Continuous authentication versus per-action gating",
"hub": {
"slug": "topics/remote-workforce-identity",
"title": "Remote workforce identity"
},
"answer": "Gating, on the small set of actions that cause it. Continuous authentication produces a confidence score that has to be thresholded, and every threshold is either too loud to act on or too quiet to catch a patient operative. Gating produces a signature or nothing.",
"answer_q": "Which approach actually stops the loss?",
"glossary": [
{
"term": "Continuous authentication",
"def": "Ongoing behavioural assessment producing a confidence score rather than a discrete decision."
},
{
"term": "Per-action gating",
"def": "Requiring a fresh cryptographic assertion at a specific, consequential action."
},
{
"term": "Threshold problem",
"def": "The impossibility of setting a score cut-off that is both actionable and sensitive."
}
],
"checklist": {
"title": "Choosing gates that matter",
"id": "gates",
"desc": "Five steps.",
"steps": [
{
"name": "List the actions where loss is actually realised.",
"text": "Usually far fewer than expected."
},
{
"name": "Rank them by irreversibility.",
"text": "Wire release and code signing before report viewing."
},
{
"name": "Gate the top of that list with a signature.",
"text": "Over the rendered effect, not the request."
},
{
"name": "Leave continuous signals as routing input.",
"text": "Useful for investigation, poor for blocking."
},
{
"name": "Measure prompt volume per person per week.",
"text": "If it exceeds a handful, the gates are wrong."
}
]
},
"cta": {
"title": "Where this fits in Manav",
"html": "Manav is a gating primitive: a hardware signature over the rendered effect at the moment it happens, verifiable offline afterwards.",
"href": "../docs.html",
"label": "See how gating works"
}
}