Flag sign-ins that cannot be physically real. When the same user appears in two places far apart within a window shorter than travel would allow, it usually means a token or session is being reused from a new location. Lidar's `impossible_travel` monitor raises a Signal against the subject so you can challenge or step up.

## What you use

- The Lidar `impossible_travel` monitor (`detection:impossible_travel distanceKm:>5000`), correlated by subject.

## Setup

1. Confirm [Lidar access](/docs/console/lidar) is approved for the environment.
2. Under **Lidar > Monitors**, enable `impossible_travel`. The default `distanceKm:>5000` is advisory text injected into the detector prompt, not a hard gate; tune it to the distance that matters for your user base.
3. Pair with [step-up](/docs/mfa) or a challenge step in your app for users who trip the monitor, rather than blocking outright; a real user on a VPN can look like impossible travel.

## Verify

- In dev, sign in as one user from two geographically distant IPs within a few minutes: a Signal appears against that subject.
- Confirm a normal sign-in from the user's usual location does not fire.
- Triage the Signal in [Lidar > Signals](/docs/console/lidar); the finding is a derived detection, so correlate with neighboring [audit events](/docs/audit-logs) before remediating.

## Related

- [Lidar concepts](/docs/concepts/lidar): subject-keyed correlation and the role of advisory tokens.
- [Audit logs](/docs/audit-logs): the underlying event trail to correlate against.
- [MFA](/docs/mfa): step-up as the response to a Signal.