> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Create resource rules Resource rules protect access to your applications by requiring users to pass a predetermined risk assessment and authentication requirements. You can create a new resource rule for an application or clone an existing resource rule. Resource rules use an authentication flow to determine how a user authenticates to a protected resource. You can create authentication flows as you build a resource rule or create them in advance. See [Create authentication flows](/docs/authentication-and-security/create-and-manage-resource-rules/create-authentication-flows.md) for more information. Before you begin, review [Create and manage resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md) to understand how resource rules apply access filters, risk factors, authentication flows, SSO behavior, and access denial. Also review the terminology and tips on this page before you build a resource rule graph. ## Terminology and tips Before you begin building your resource rule, review the following terminology and tips. ## Graphs When you build a resource rule, you create a graph. The following explains the terms used in the graph. ![Resource Rule Terminology](/assets/images/resource-rule-terminology-4524e7ca10591182d18b6165eda538ff.png) - **Node.** The rectangle components in a graph. - **Edge.** The line that connects two nodes. - **Handle.** The connection point on a node where edges can be attached (the grey circle on the top or the bottom on the node). - **Canvas.** The empty space in the graph building area. - **Settings.** The configuration options for a node added to a resource rule graph. They appear on the side of the graph area when a node is selected. ## Side bar The **Side bar** includes the following icons: | Icon | Description | | --------------------------- | ------------------------------------------------------------------------------------------------------------ | | Plus icon **Add** | Opens the **Task** menu to add nodes to your graph. Click again or click anywhere in the Canvas to close it. | | Wand Sparkles icon **Tidy** | Improves the appearance of your graph. | | Undo icon **Undo** | Undoes your last change. | | Redo icon **Redo** | Redoes your last undone change. | | Check icon | No errors found. | | Circle Alert icon | Error detected. | ### Task menu nodes The following table describes each node available in the **Task** menu and its purpose. | Node | Description | | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Access Filter** | | | Authentication Context References | Configure to evaluate users with an ACR specified in their request. This resource rule can be considered only for matching ACR requirements. See [Add Authentication Context References](/docs/authentication-and-security/create-and-manage-resource-rules/add-authentication-context-references.md) for more information. Available for SAML, OIDC and OAuth, Authentication API, and IDaaS applications. | | Domain-based IdP | Configure to evaluate users that are associated or not associated with a domain. This resource rule can only be considered for matching domain requirements. Available for the User, User Edit, and Administrator portals, and SAML and OIDC and OAuth applications. | | Group | Configure the group of users that are evaluated based on the resource rule. This resource rule can only be considered for matching group requirements. | | **Risk Factors** | | | Date/Time | Configure allowed date ranges, time of day, and time zones. This risk factor applies to all applications, but it is the only applicable risk factor for Entrust Identity Enterprise Legacy applications. | | Device Verification | Require a user to perform device verification. No configuration required. Not available for RADIUS applications. | | External | Add External Risk Engines as a risk factor. See [Manage external risk engines](/docs/authentication-and-security/manage-external-risk-engines.md) for more information. Available only for Authentication APIs and Identity as a Service and OIDC and OAuth applications. | | Geolocation | Configure to allow or deny access from specific countries. | | Source IP Address | Configure allowed or denied IP addresses. | | Location History | The Risk-Based Authentication (RBA) settings of your Identity as a Service account define the location history. There is no additional configuration required. See [Manage risk-based authentication settings](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings.md) for more information. | | Machine Authentication | Configure risk points for device fingerprint mismatches. This risk factor is not applicable to RADIUS applications. | | Transaction | Used to set Transaction Condition settings. See [Manage transactions](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings/manage-transactions.md) for more details about transactions. Available for Identity as a Service, Authentication API, and OIDC and OAuth applications using the JWT IDaaS grant type. | | Travel Velocity | The Risk-Based Authentication (RBA) settings of your Identity as a Service account define the travel velocity conditions. There is no additional configuration required. See [Manage risk-based authentication settings](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings.md) for more information. | | **Logic Task** | | | Access Evaluation | Set the access requirements users must meet to be able to access the resource. | | Risk Evaluation | Set the risk evaluation to determine a user's risk to allow or deny access to the protected resource. | | **Auth Task Result** | | | Allow Access | Allow access to the protected resource. | | Deny Access | Deny access to the protected resource. | ## Building tips ### Interacting with the graph - Click in the Canvas to display the **General Settings**. - Click a node to display the settings for that node. - To hide the **Task** menu, click anywhere in the Canvas. ### Adding and removing nodes - To add multiple nodes to a flow element (for example, three different risk factors), click the **Task** menu and add them to the Canvas first, then arrange them and connect them with edges to the connecting node in the flow (either **Start** or **Access Evaluation**). - Hover over a node or an edge between two nodes to see the Circle Plus icon symbol, then click it to see the nodes you can add at that position. For example, if you added a Geolocation risk factor connected to the **Start** node and want to insert a Group Access Filter, click the add symbol on the edge between them to insert the node directly. - To delete a node, select it in the graph and press **Delete**, or click the node to display its settings and click the **Delete** icon in the settings panel. - To delete a risk factor, delete it from the graph or click the node to display its settings and click the **Delete** icon. ### Saving and tidying - Click **Save** to save your changes as you build the resource rule. - After adding nodes, click the **Tidy** button to clean up the graph layout and reduce the space it takes on the Canvas. ## Topics in this section [📄️Sample resource rule graphs A resource rule follows this flow:](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules/sample-resource-rule-graphs.md) [📄️Error messages When building a resource rule graph, the Side panel displays error messages if any are found in the graph, using the following icons:](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules/error-messages.md) [🗃Rule settings 3 items](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules/add-a-resource-rule.md) [📄️Rule management After you create a resource rule, you can edit, delete, and enable or disable them as required.](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules/manage-resource-rules.md)