Positive Friction

How Positive Friction Works in Identity Security

Positive friction is not meant to stop legitimate access, it is meant to make high-risk actions pause long enough for intent, context, and authority to be checked. That slight delay changes the economics of abuse by forcing a human or system to complete an extra step before privilege is used.

In practice, the control is most valuable where the action is both sensitive and reversible, such as elevating privileges, using a sensitive secret, approving access, or invoking an automated action with downstream impact. The core idea is to slow the action just enough to surface errors, policy violations, or malicious intent without turning normal work into a bottleneck.

Where Positive Friction Fits in Access Decisions

Positive friction sits between raw access and unconditional execution. It is a design choice that adds deliberation to the point where trust is being converted into action, which is why it often appears in privileged workflows, identity governance, and higher-risk automation paths.

It is especially useful when a single click, token, or approval would otherwise create broad exposure. By introducing a checkpoint before the action is completed, organisations can separate routine activity from activity that deserves closer scrutiny, stronger assurance, or a second set of eyes.

Common Forms of Positive Friction

Positive friction can take several forms, and the best choice depends on what kind of risk is being reduced. Approval workflows add human review, step-up authentication adds stronger proof before the action proceeds, and policy review can block or delay actions that do not meet predefined conditions.

Other forms include just-in-time access expiry, re-authentication for sensitive operations, device or location checks, and confirmation prompts for destructive or high-impact tasks. The shared pattern is that the user can still proceed, but only after the system asks for more intent or more evidence.

• Approval is useful when a second human judgement is the control.
• Step-up authentication is useful when the main concern is stronger identity assurance.
• Policy review is useful when the main concern is whether the action fits the rules of use.
• Timed access and re-confirmation are useful when the risk increases with duration or repetition.

How Positive Friction Changes Security Outcomes

Well-designed friction reduces impulsive mistakes, discourages opportunistic abuse, and increases the chance that abnormal behaviour is noticed before damage occurs. It also creates an audit trail around the decision itself, which is valuable when the question is not only who had access, but why the access was used at that moment.

For identity security teams, that means the value is not just in the slowdown. The value is in forcing a higher-quality decision at the exact point where trust, privilege, or automation could be misused.

Risk and Threat Considerations

Positive friction can fail if it is so heavy that people bypass it, approve without review, or route around the intended workflow. It can also create blind spots if the control is treated as a substitute for least privilege, monitoring, or strong authentication.

Failure mechanism: Attackers and insiders benefit when the friction point is predictable, poorly reviewed, or easy to rubber-stamp, because the control then becomes theatre rather than a meaningful checkpoint.

Impact: The organisation may preserve a formal approval step while still allowing privilege abuse, secret misuse, or unsafe automation to proceed with little real resistance.

Practitioner Guidance

Why practitioners should care: Positive friction works best when it is targeted at the highest-risk actions, not spread across every workflow. The strongest designs make the risky path just hard enough to force deliberate action while leaving low-risk work fast and routine.

What to watch for: If users start requesting exceptions, sharing approvals, or complaining that the control blocks ordinary work, the friction is probably miscalibrated. That usually means the control needs tuning around risk, context, and workflow timing rather than removal.

Practitioner takeaway: The best positive friction feels almost invisible until a risky action occurs, then it becomes the moment that prevents a bad decision from becoming an incident.

Related resources from NHI Mgmt Group

• When does zero trust IAM create more friction than risk reduction?
• How should organisations implement PSD2 controls without adding too much checkout friction?
• How should security teams implement zero trust authentication without adding too much user friction?
• How should security teams replace traditional MFA without creating new access friction?