The “binary” authentication model of “logged in or not logged in” is too simplistic. This leads to endless design compromises, either making applications hard to use, or insecure, or often both. Some of the most forward-thinking sites and services are moving to a more granular and nuanced model, where individual actions are evaluated for authorization based on risk, informed by a variety of inputs (previous actions, IP, recent history, various forms of authentication by the user), and different levels of additional authentication requested only when necessary. We describe a general framework for this kind of authentication model, and security and usability improvements, and how you can use this to protect your services as an application developer, sysadmin, or security consultant.