What is the difference between Decision Point and Switch in the Flowchart?

Short answer

Both split the flow into branches in the Flowchart. Decision Point evaluates the selected Conditions records and splits the flow into two branches: if the condition is met, the flow continues from the YES output, and if it is not met, from the NO output. Switch, on the other hand, compares a value (Switch Variable) with the branch patterns and splits the flow into many branches: the flow continues from the output of the matching branch, and if no branch matches, from the noMatch output.

How Does It Work?

• Decision Point: Conditions records that belong to the HTTP request are selected; the conditions within a group and the groups are combined with AND/OR. With the AGS Condition criterion, the session and user information is examined as well (e.g. taking a user whose AGS user groups value contains admins to an additional MFA step after authentication); the number of failed attempts is not among the variables of this criterion, and the behavior according to the number of attempts is set up with Account Lockout Policies.
• Switch: An expression that contains an AGS variable is entered in the Switch Variable field (e.g. %AGS_USER_ATTR(department)). The value is compared with the Pattern value of each branch in the Branches list according to the Match Mode rule; each branch becomes a separate output below the box.

Comparison

	Decision Point	Switch
Input	One or more Conditions records	A single value (Switch variable)
Number of branches	Two: YES, NO	As many outputs as there are branches, plus noMatch
Comparison	The condition's own operator	Match Mode: Exact Match, Starts With, Ends With, Contains, Regular Expression
Upper/lower case	According to the setting of the condition	Case Insensitive (off by default; in the modes other than Regular Expression)
When	A split according to whether a condition is met (e.g. not asking for MFA from those who come from a specific network)	A split according to which of several possibilities a value matches (e.g. a different provider according to the department or the group)

Decision Point and Switch in TR7

• Both steps are added from the Add AGS Action window on the Flowchart tab; they do not use a profile, and their settings are in the step itself.
• In Decision Point, the Conditions field is mandatory; the step is not added with an empty condition group.
• In Switch, Switch Variable, Match Mode and at least one branch Pattern value are mandatory.

Common Misconceptions

• "If no branch matches in Switch, the flow stops." When there is no match, the noMatch output is used; this output is also connected to a step.
• "Decision Point works only with AGS conditions." All the Conditions records that belong to the HTTP request can be selected; AGS Condition is one of them.
• "The patterns of Switch are always regex." Match Mode determines how the pattern is interpreted; the pattern is evaluated as a regular expression only in Regular Expression mode.

How it is done in the documentation

• Flowchart · Decision Point
• Flowchart · Switch
• Flowchart · Match Mode
• AGS Condition · What Is AGS Condition?

Related questions

• What is the Flowchart; which step types does an AGS flow consist of?
• What do AGS Activation Condition and AGS Root Path determine?
• How is AGS used together with Load Balancer conditions and the WAF?