RG Score Reference

The RG Score is a composite risk score between 0 and 100 assigned to each user for each of four time windows. It gives operators a single, easy-to-read number that summarizes multiple behavioral signals, making it straightforward to sort and prioritize users in the queue.

This page explains what the score measures, how it is calculated, and what the different score ranges mean in practice.

#Score Formula

For each time window (7d, 30d, 180d, 365d), the RG Score is the sum of five components:

$$\text{RG Score} = E + R + P + C + S$$

The maximum possible score is 100.

#Shared Definitions

Flagged message — A message with a model probability score of 0.60 or above. The probability score represents the model's confidence that the message belongs to the at-risk class.

Average flagged probability — The mean probability score across all flagged messages in the window. Used only within the Evidence component as a small confidence bonus.

Flagged ratio — Flagged messages divided by total messages in the window.

Distinct flagged days — The number of separate calendar days in the window that contain at least one flagged message.

Change — The difference in flagged message count between the current window and the previous equivalent window (e.g., current 7d versus the 7d before that). If no prior window data exists for a user, Change points are set to 0.

Same-day cluster — The maximum number of flagged messages sent on any single day within the window.

---

#7-Day Score

The 7-day score is the primary operational score. It drives triage queue sorting and alert triggering. Use it for daily prioritization and urgent outreach decisions.

#Evidence (0–40)

Flagged count points (0–30)

Confidence bonus (0–10)

#Ratio (0–20)

Minimum of 3 flagged messages required; otherwise Ratio points are 0.

#Persistence (0–20)

#Change (0–15)

#Same-Day Cluster Bonus (0–5)

---

#30-Day Score

The 30-day score is the secondary operational score. Use it to identify users with sustained patterns over a longer period and to prioritize follow-up outreach when the 7-day score is borderline.

#Evidence (0–40)

Flagged count points (0–30)

Confidence bonus is the same table as 7d.

#Ratio (0–20)

Minimum of 5 flagged messages required; otherwise Ratio points are 0.

#Persistence (0–20)

#Change (0–15)

#Same-Day Cluster Bonus (0–5)

Same table as 7d.

---

#180-Day Score

The 180-day score provides historical context. Use it during a user review to understand whether a current spike is part of a longer pattern or an isolated event. It is not used for alerting.

#Evidence (0–40)

Flagged count points (0–30)

Minimum of 10 flagged messages required for Ratio points; otherwise Ratio points are 0.

#Ratio (0–20)

#Persistence (0–20)

#Change (0–15)

#Same-Day Cluster Bonus (0–5)

---

#365-Day Score

The 365-day score provides long-term tracking and historical risk context. Use it for compliance reporting and to understand a user's history across a full year. It is not used for alerting.

#Evidence (0–40)

Flagged count points (0–30)

Minimum of 15 flagged messages required for Ratio points; otherwise Ratio points are 0.

#Ratio (0–20)

#Persistence (0–20)

#Change (0–15)

#Same-Day Cluster Bonus (0–5)

Same table as 180d.

---

#Score Bands

The numerical score maps to a descriptive label. Labels differ between the operational windows (7d and 30d) and the historical windows (180d and 365d).

#7-Day and 30-Day (Operational)

#180-Day and 365-Day (Historical Context)

---

#Score Update Intervals

All windows use a rolling trailing calendar-day window in the operator's local timezone. For example, the 7-day window covers today plus the previous 6 calendar days.

---

#Alerts and Scores Are Independent

It is expected and by design that a user can trigger an alert while still having a low or moderate RG Score. Alerts are intentionally more sensitive than the score — they react to a single strong signal within the 7-day window — whereas the score reflects a balanced combination of all five components across the full window. Treat an alert as "look at this user now" and the score as an overall pattern of behavior.