A useful input, distinct from the decision it feeds
A risk score is a computed estimate, typically built from many weighted signals, of how suspicious a given request appears — used to adjust an authorization outcome rather than to constitute that outcome by itself. A request that scores as unusually risky might trigger additional verification or a closer review; one scoring as ordinary proceeds under the system's standard rules. Used this way, a risk score sharpens where scrutiny gets applied without replacing the underlying policy that scrutiny is checking against.
The distinction matters because a risk score is inherently probabilistic — built from correlations and patterns rather than a definitive rule — and treating it as if it were definitive quietly substitutes a probabilistic guess for what was supposed to be a deterministic policy decision, at precisely the point that decision was meant to matter.
Where the substitution tends to happen unnoticed
The failure mode isn't usually a deliberate decision to replace policy with a score; it's a low-risk score being allowed, gradually and without much scrutiny, to silently bypass a check that would otherwise apply — a shortcut that looks harmless in isolation and, cumulatively, hollows out the actual rule it was meant to merely inform. Keeping the score's role explicitly bounded to modulating scrutiny, and never to replacing the underlying decision, is what keeps this from happening by drift rather than by design.