Optimize identity assurance response portfolio

What it's for

Converts identity-risk exposure into a costed, capacity-aware and human-governed response frontier that explicitly prices both compromise and false-positive harm.

What you give it

Inputs split into evidence read from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.

{
  "identity_provider_groups": [
    {
      "evidence_verified": true,
      "id": "idp-core",
      "unique_common_loss_scenarios": [
        500000,
        1000000
      ]
    }
  ],
  "identity_risk_cases": [
    {
      "allowed_action_type_ids": [
        "monitor",
        "reverify"
      ],
      "compromise_prior_alpha": 2,
      "compromise_prior_beta": 8,
      "direct_loss_scenarios": [
        200000,
        400000
      ],
      "evidence_verified": true,
      "id": "case-admin",
      "identity_provider_group_id": "idp-core",
      "legitimate_access_value_scenarios": [
        300000,
        250000
      ],
      "maximum_residual_compromise_probability": 0.15,
      "minimum_legitimate_access_retention_fraction": 0.8,
      "required_control_ids": [
        "identity-check"
      ]
    }
  ],
  "random_seed": 42,
  "resource_capacities": [
    {
      "capacity": 1,
      "evidence_verified": true,
      "id": "assurance-hours"
    }

What you get back

This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.

{
  "assumptions": [
    "Risk cases use auditable account-security evidence and calibrated priors; response detection, remediation, false-positive, access-retention, cost and resource effects are prospectively validated in the local organization.",
    "Disruptive options are eligible only with recorded human approval, legal basis and due-process readiness; common provider loss is counted once and exact optimality is claimed only after complete enumeration."
  ],
  "baseline_current_state": {
    "conditional_value_at_risk": 1400010,
    "expected_false_positive_disruption_loss": 0,
    "expected_net_value": 158619.015,
    "expected_security_loss": 126600,
    "selected_option_ids": [
      "monitor"
    ]
  },
  "constraints": {
    "resource_capacities": {
      "assurance-hours": 1
    },
    "response_budget": 100,
    "risk_aversion": 0.25,
    "tail_probability": 0.05
  },
  "decision": "review_governed_identity_assurance_response_portfolio",
  "failed_gates": [
    {
      "gate": "maximum_residual_compromise_probability_exceeded",
      "rejected_state_count": 1
    }
  ],
  "limitations": [
    "The optimizer chooses among preauthorized account-security responses; it does not infer identity, nationality, espionage, guilt, concurrent employment or employee suitability and cannot recommend hiring, firing or punishment.",
    "No output itself authorizes surveillance, investigation, external disclosure, access removal or employment action; accountable humans must review evidence, proportionality, correction rights and applicable law."
  ],
  "method": "beta_binomial_false_positive_common_idp_cvar_response_portfolio_v1",
  "portfolio_pareto_frontier": [
    {
      "conditional_value_at_risk": 1036928.8,
      "expected_net_value": 214016.515,
      "selected_option_ids": [
        "reverify"
      ]
    }
  ],
  "reproducibility": {

How it works

Sequential Bayesian & bandits — Learn while deciding — update beliefs as evidence arrives and choose where the next unit of effort is worth spending.

1. 1 Draw calibrated Beta-binomial compromise risk and coherent scenarios, then evaluate each case-option combination for individual and shared-provider security loss, retained legitimate access and false-positive disruption.
2. 2 Reject portfolios violating allowed actions, required controls, risk ceilings, retention, scenario availability, dependencies, exclusions, budget, resources or disruptive-action governance.
3. 3 Use exact Cartesian enumeration when tractable and a deterministic economic beam otherwise; report the current baseline, selected portfolio, CVaR and non-dominated value-risk frontier.

Before you trust it

Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.

Calibrating it to your org

Calibration workflow

1. 1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
2. 2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
3. 3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
4. 4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
5. 5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
6. 6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.

Call it from your AI

You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 18 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.

gitrevio_capabilities_search
  { "q": "choose one preauthorized identityassurance response per" }
  → finds "optimize_identity_assurance_response_portfolio"

gitrevio_capability_describe
  { "capability_id": "optimize_identity_assurance_response_portfolio" }
  → returns the input schema and agent guidance shown on this page

gitrevio_capability_run
  { "capability_id": "optimize_identity_assurance_response_portfolio", "arguments": { ... } }
  → returns the result shown above

Works in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.

Related tools

See every tool in Security, access & compliance →