Velocity

Velocity is how fast activity is piling up for one user or IP. People act at human pace: they read, pause, navigate, come back later. Automated traffic and heavily shared accounts don't, so a burst of activity well past what one person produces is a useful tell. The has_high_velocity check flips true when the rate for an account or address crosses what's normal for a single human.

What it catches

• Scraping: a script hitting an endpoint far faster than anyone could click is the textbook high-velocity case.
• Account sharing: when many people use one login, the account's combined activity runs hotter than any individual would.

Using it

has_high_velocity weights into both the scraping and account-sharing risk scores, and you can match it directly in a policy. It pairs naturally with the anonymizing network flags for scraping (fast traffic from a datacenter IP) and with concurrency for sharing (fast traffic from two places at once). On its own, treat it as a reason to add friction rather than to hard-block. A genuine power user can occasionally run hot.