CAEP

Continuous Access Evaluation Protocol. A specification for communicating security-relevant session events, such as a credential change, a device falling out of compliance, or an assurance-level change, from one party to another so access decisions can be revised mid-session rather than only at login.

CAEP exists because federation has a structural gap: a token issued for an hour stays valid for an hour, whatever happens in minute two. Without out-of-band signalling, a relying party cannot know the user was disabled, the device was quarantined, or the session was hijacked. CAEP defines the event types; the Shared Signals Framework defines how they are delivered between a transmitter and a receiver. It was invented at Google and is now published by the OpenID Foundation.

See also: Shared Signals Framework, session hijacking, token theft, Atul Tulshibagwale, Zero Trust