# shared-signals-framework

Source: https://startwithidentity.com/glossary/shared-signals-framework/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

An OpenID Foundation specification defining how security events are shared between cooperating parties: how a transmitter and receiver establish a stream, how events are delivered by push or poll, and how delivery is acknowledged. CAEP and RISC are profiles that define the event types carried over it.

The framework matters because signalling only works if both sides implement the same mechanics. Delivery is specified in RFC 8935 (push) and RFC 8936 (poll), using Security Event Tokens, a JWT profile for representing an event. Adoption is the hard part: a signal is only useful if the receiving application acts on it, which means revoking a session rather than logging the event.

See also: [CAEP](https://startwithidentity.com/glossary/caep/), [ITDR](https://startwithidentity.com/glossary/itdr/), [JWT](https://startwithidentity.com/glossary/jwt/), [Annabelle Backman](https://startwithidentity.com/experts/annabelle-backman/), [RISC](https://startwithidentity.com/glossary/risc/), [Security Event Token](https://startwithidentity.com/glossary/security-event-token/), [Shared Signals Framework standard](https://startwithidentity.com/standards/shared-signals-framework/)