# caep

Source: https://startwithidentity.com/glossary/caep/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

Continuous Access Evaluation Protocol. A specification for communicating security-relevant session events, such as a credential change, a device falling out of compliance, or an assurance-level change, from one party to another so access decisions can be revised mid-session rather than only at login.

CAEP exists because federation has a structural gap: a token issued for an hour stays valid for an hour, whatever happens in minute two. Without out-of-band signalling, a relying party cannot know the user was disabled, the device was quarantined, or the session was hijacked. CAEP defines the event types; the Shared Signals Framework defines how they are delivered between a transmitter and a receiver. It was invented at Google and is now published by the OpenID Foundation.

See also: [Shared Signals Framework](https://startwithidentity.com/glossary/shared-signals-framework/), [session hijacking](https://startwithidentity.com/glossary/session-hijacking/), [token theft](https://startwithidentity.com/glossary/token-theft/), [Atul Tulshibagwale](https://startwithidentity.com/experts/atul-tulshibagwale/), [Zero Trust](https://startwithidentity.com/glossary/zero-trust/), [RISC](https://startwithidentity.com/glossary/risc/), [Shared Signals Framework standard](https://startwithidentity.com/standards/shared-signals-framework/)