diff --git a/packages/account-core/src/index.test.ts b/packages/account-core/src/index.test.ts
index bbbe93f..6f67303 100644
--- a/packages/account-core/src/index.test.ts
+++ b/packages/account-core/src/index.test.ts
@@ -24,6 +24,13 @@ describe("account-core", () => {
     expect(riskBandForScore(score)).toBe("high");
   });
 
+  it.each([Number.NaN, Number.POSITIVE_INFINITY, Number.NEGATIVE_INFINITY])(
+    "classifies a non-finite risk score of %s as critical",
+    (riskScore) => {
+      expect(riskBandForScore(riskScore)).toBe("critical");
+    }
+  );
+
   it("requires approval for gated actions with matching grants", () => {
     const result = evaluateAccountPolicy({
       action: "email:send",
diff --git a/packages/account-core/src/policy.ts b/packages/account-core/src/policy.ts
index 4d40d92..d91cd4b 100644
--- a/packages/account-core/src/policy.ts
+++ b/packages/account-core/src/policy.ts
@@ -14,6 +14,9 @@ const WRITE_ACTIONS = new Set([
 ]);
 
 export function riskBandForScore(score: number): LogicSrcRiskBand {
+  if (!Number.isFinite(score)) {
+    return "critical";
+  }
   if (score >= 0.75) {
     return "critical";
   }