Login and access protection

How to operate sensitive authentication attempts without losing traceability or continuity.

Mature login defense does not seek only to prevent failed attempts. It also distinguishes legitimate habits, posture changes, newly added devices, and coordinated pressure on critical accounts or systems.

When a case affects real identities, combine Login Shield with Access, incidents, and Evidence so containment does not interrupt continuity without context.

Checklist

• Locate the most sensitive authentication routes.
• Cross-check the signal with sessions and devices in Access.
• Escalate to an incident if the pattern compromises institutional continuity.

Quickstart

1. Review login routes with sessions and devices, never in isolation.
2. Check whether the applied friction matches the criticality of access.
3. Record Evidence if the case led to session closure or revocation.

Operational flow

Detect

The shield flags attempts by pace, route, pattern, or source trust.

Confirm whether access is legitimate or requires containment.

Connect with Access

Review devices, trust score, active sessions, and current policies.

Avoid responses that ignore access continuity.

Escalate or close

Close sessions, review policies, or open an incident according to impact.

Leave enough traceability to reopen or audit the measure.

flowchart LR
  S1["Detect"]
  S2["Connect with Access"]
  S3["Escalate or close"]
  S1 --> S2
  S2 --> S3

Validators and checks

They run a contextual reading for this surface and return suggested steps with an operational focus.

Validate login and continuity

Cross-checks the login surface with Access and related articles.

Examples

Payload for reviewing a sensitive login

{
  "moduleKey": "login-shield",
  "query": "credential stuffing session risk",
  "domain": "login.capacero.ar"
}

Links and references

Related routes

APIs

/api/adda/v1/shields/events
/api/adda/v1/access/sessions
/api/adda/v1/access/devices

Docs and supporting routes

docs/ADDA_WAF.md
docs/ADDA_API.md

Common issues

• Applying friction without reviewing active sessions can interrupt valid institutional access.
• Failing to link Login Shield with Access reduces the explanation to a superficial event.

Suggested actions

• Escalate to Access before revoking or closing multiple sessions.
• Leave a manual candidate if the operator needed undocumented criteria to respond.

Useful reason codes

Score dictionary

wafRiskScore

Risk detected on the observed route or form.

decision

Decided action: allow, verify, limit, or block.

matchedRules

Rules that explain why protection was activated.

Protocol notes

• Secure access continuity is part of the defense, not an exception.

Article history

Jul 9, 2026

Added a Login Shield article linked to Access and operational continuity.