> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Sample resource rule graphs

A resource rule follows this flow:

1. **Start**: The **General** **Settings** to input the name and description of the resource rule.

tip
Anytime you click in the Canvas of the graph, the **General** **Settings** appear.

- **Access Control**: Optional. Set Authentication Context References, Domain-based IdP, and Groups to further streamline whether users accessing the resource can have access to this resource rule. They must connect to Access Evaluation.
  - **Authentication Context References**: Configure to evaluate users with an ACR specified in their request. See [Add Authentication Context References](/docs/authentication-and-security/create-and-manage-resource-rules/add-authentication-context-references.md) for more information.
  - **Domain-based IdP**: Evaluate users that are associated or not associated with a domain.
  - **Group**: Set the group of users that are evaluated.

2. **Access Evaluation**: Connect the Access Filters to the Risk Factors.

3. **Risk Factors**: Add the Risk Factors that are evaluated in the Risk Assessment. They must be connected to Risk Evaluation.

4. **Risk Evaluation**: Determine the user risk levels assessed by the risk factors.

5. **Authentication Tasks**: Add the Authentication Results for low, medium, or high risk to determine the authentication flow required to allow or deny access to the protected resource.

## Examples

### Basic Template

This is the template presented to you when creating a new resource rule. It is a simple resource rule with no additional risk factors.

![Basic Template](/assets/images/basic-template-a766c9364c8040fdf139712b13e3cbd8.png)

### Access Filters

Access Filter nodes (Groups, Domain-based IDP, Access Context Reference) must connect to start and the **Access Evaluation** node. Access filters are optional.

![Access Filters](/assets/images/access-filters-1cd76a075b9a305bdb011016db7af4d2.png)

### Risk Factors

All risk factors must connect to a **Risk Evaluation** node. If Access Filters are present, the top of the risk factor nodes must connect to the Access Evaluation node (Figure A). Otherwise, they must connect to start (Figure B).

Figure A

![Figure A](/assets/images/risk-factors-access-filters-e7edfa3aac4dbc58695acb186772995a.png)

Figure B

![Figure B](/assets/images/risk-factors-no-access-filters-17fcee20c4466d93f5eacd29a430e6ba.png)

### Risk Evaluation/ Authentication Flow

The Risk Evaluation node has three handles and can have three outgoing edges that represent the low, medium, and high authentication flows.

![Risk Evaluation/ Authentication Flow](/assets/images/risk-evaluation-authentication-flow-e8f86bdb006ffd6d15cad9eaae212f41.png)