CAEP
Continuous Access Evaluation Protocol. A specification for communicating security-relevant session events, such as a credential change, a device falling out of compliance, or an assurance-level change, from one party to another so access decisions can be revised mid-session rather than only at login.
CAEP exists because federation has a structural gap: a token issued for an hour stays valid for an hour, whatever happens in minute two. Without out-of-band signalling, a relying party cannot know the user was disabled, the device was quarantined, or the session was hijacked. CAEP defines the event types; the Shared Signals Framework defines how they are delivered between a transmitter and a receiver. It was invented at Google and is now published by the OpenID Foundation.
See also: Shared Signals Framework, session hijacking, token theft, Atul Tulshibagwale, Zero Trust, RISC, Shared Signals Framework standard
Related on Start with Identity
- GlossarymTLS
Mutual TLS. Both the client and server present and validate X.509 certificates during the TLS handshake. The cryptographic identity binding makes mTLS a strong
- GlossarySecurity Event Token (SET)
A Security Event Token (SET) is a JWT that states that a security event occurred to a subject, defined in [RFC 8417](https://www.rfc-editor.org/rfc/rfc8417) (Pr
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- PodcastKuppingerCole Analyst Chat
Weekly conversations between KuppingerCole analysts on identity architecture, governance, AI agents, and the market. Over 300 episodes since 2020.