Signup protection works best as a sequence, not a single verdict: use CAPTCHA before account creation when the request already looks automated, then apply risk scoring after signals from the attempted signup are available. That placement preserves a clean audit trail and keeps a suspicious attempt from becoming a durable credential. The decision is about bot resistance, not about making every honest person solve a puzzle. Architecture decision record The invariants are straightfo...