#standards

Public TLS certificates are already capped at 200 days. On March 15, 2027 the cap falls to 100 days, and Chrome's root program stops accepting new public certificates that also carry client authentication, which quietly breaks mTLS setups built on public CAs. Why that date, not 2029, is the one to plan around, and the order to automate in.

The EU Cyber Resilience Act, Regulation (EU) 2024/2847, writes authentication and secure defaults into law for products sold in the EU, and lists identity management, PAM and password managers as important products. Its reporting duty started on 11 September 2026. What it asks of teams that buy identity products and teams that build them, and what to do before December 2027.

SCIM 2.0 is a decade old and the create path works almost everywhere. The failures that leave access behind sit in deactivation, group membership and PATCH, where RFC 7643 and 7644 leave room for two correct implementations to disagree. What breaks, why, and a test plan for the leaver path.

At Authenticate 2026 on October 20, the FIDO Alliance said it will publish the Credential Manager Reference Architecture and a Framework for Verifier Identification in the coming weeks, and opened an External Advisory Forum for issuers, governments and regulators.

FIDO's Passkey Index 2026 says 36% of successful sign-ins at 15 consumer services now use a passkey, and that passkey sign-ins succeed 93% of the time against 78% for passwords and traditional MFA. The finding that should change your rollout plan is smaller: enrolled users still get routed to the password.

NIST launched a resource site for the Digital Identity Guidelines, Revision 4, with FAQs, version 0.1 conformance criteria in Excel, PDF and OSCAL, a subscriber-controlled wallet explainer, and an authenticator reference. It adds no new requirements.

W3C published WebAuthn Level 3 as a Recommendation on August 25, 2026. Conditional create, the Signals API, Related Origin Requests, and the PRF extension stop being working drafts and become a citable normative reference.

Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The delegation standard is arriving faster than the governance around it.

Regulation (EU) 2024/1183 anchors national EUDI Wallet availability to 24 December 2026. Most coverage treats this as a public sector milestone. The obligations that will surprise people fall on relying parties.

Two unauthenticated bypasses in the miniOrange SAML 2.0 Single Sign On plugin, CVE-2026-61979 and CVE-2026-15981, treat OpenSSL's error return as a valid signature. Both are under active exploitation.

Okta made Agent SSO generally available on August 24, 2026, registering AI agents in Universal Directory with short-lived governed tokens and pushing Cross App Access into the Model Context Protocol as its enterprise authorization extension.

RFC 9207 issuer validation is now mandatory, dynamic client registration is deprecated in favour of client ID metadata documents, and an enterprise extension lets admins govern agent access through Entra ID or Okta instead of per-server consent clicks.

EMVCo published a draft framework for verifiable digital credentials in card-based payments, aimed at giving merchants one consistent data structure to authenticate against regardless of which wallet or payment network a customer uses.

We catalogued 86 national digital ID schemes across 51 countries. The patterns that emerge, mobile-first, bank-led, biometric, and wallet-bound, tell you where identity is going and what to build for.

Google's Agent Payments Protocol and Mastercard's Verifiable Intent framework, both contributed to the FIDO Alliance for standardization, define how an AI agent proves a user actually authorized a specific purchase, since the old assumption that a human is present at checkout no longer holds.

VC Data Model 2.0 reached W3C Recommendation on 15 May 2025, moving verifiable credentials from a promising draft to a standard the W3C recommends for wide deployment. It admits several securing mechanisms rather than mandating one.

NIST's rewrite of the Digital Identity Guidelines reached final publication in July 2025 after roughly four years and about 6,000 public comments. It brings syncable passkeys into scope, admits subscriber-controlled wallets to the federation model, and adds controls for injection attacks and forged media.