# Human Interaction Signature (HIS)

Human Interaction Signature (HIS) is Sentinel's interaction-based detection layer. Instead of relying only on computational cost, HIS observes how a visitor interacts with the page and turns that into a signal estimating whether the session is human or automated — an additional protection layer on top of proof-of-work.

## How it works

**Automation probability.** HIS analyzes interaction signals — pointer and touch movement, page scrolling, element focus and navigation — against patterns that are algorithmically difficult for automated agents to replicate convincingly.

**Interaction signature.** HIS also derives a hash of interaction characteristics (timing, sequence, movement patterns) unique to that session. This is what prevents a recorded or replayed interaction from being reused across separate verification attempts — a captured signature from one session doesn't transfer to another.

Both outputs feed into the overall risk score alongside [Threat Intelligence](/docs/sentinel/features/threat-intelligence/) and other [detection signals](/docs/sentinel/features/detection-signals/), driving [Adaptive Captcha](/docs/sentinel/features/adaptive-captcha/)'s difficulty decisions and your Security Group's enforcement policy.

## Requirements

- Sentinel version 1.25.0 or later
- Proof-of-Work v2
- ALTCHA Widget v3

The HIS collector is enabled by default in the ALTCHA widget (`humanInteractionSignature`). See [Widget Integration](/docs/integration/widget/#advanced--debugging) for the client-side option.

## Protection modes

Set the mode in your Security Group's HIS settings:

| Mode | Blocks on automation | Adjusts difficulty | Signature reuse |
|---|---|---|---|
| **Monitor** | No | No | Yes |
| **Relaxed** | No | Yes | Up to once, with a low penalty |
| **Strict** | Yes, at/above `hisBlockThreshold` (default 80%) | Yes | No |

- **Monitor** — for testing and baseline traffic analysis, without affecting real requests.
- **Relaxed** — general-purpose default; prioritizes user experience over strict enforcement.
- **Strict** — for high-risk endpoints (authentication, abuse-prone flows) where you're willing to trade some friction for stronger enforcement.

## Configuration

Set via the `his`, `hisBlockThreshold`, and `hisHashTTL` fields in a [Security Group](/docs/sentinel/configure/security-groups/#schema) rule's `set` action:

- **`hisBlockThreshold`** — the automation-probability threshold (0–1) at which Strict mode blocks a request. Default `0.8`.
- **`hisHashTTL`** — how long an interaction signature is retained to detect reuse. Default `12h`, minimum `10m`; the effective TTL is also adjusted based on the automation score.

## Limitations

- HIS needs roughly **3 seconds of interaction** before verification triggers, and needs interactive elements on the page beyond the widget itself to observe — a bare, static page gives it little to work with.
- It's **incompatible with `auto="onload"`**, since no interaction data has been collected yet at load time.
- HIS supports assistive technology and keyboard navigation, but these interaction patterns can register a higher automation probability than mouse/touch use. Prefer **Relaxed** or **Monitor** mode where accessibility is a priority, rather than Strict.

## Related

- [Adaptive Captcha](/docs/sentinel/features/adaptive-captcha/)
- [Autopilot](/docs/sentinel/features/autopilot/)
- [Security Groups](/docs/sentinel/configure/security-groups/) — the `his`, `hisBlockThreshold`, `hisHashTTL` rule fields.
- [Privacy Protection](/docs/sentinel/security/privacy-protection/) — what interaction data is collected and how it's handled.