Shared Signals Framework
An OpenID Foundation specification defining how security events are shared between cooperating parties: how a transmitter and receiver establish a stream, how events are delivered by push or poll, and how delivery is acknowledged. CAEP and RISC are profiles that define the event types carried over it.
The framework matters because signalling only works if both sides implement the same mechanics. Delivery is specified in RFC 8935 (push) and RFC 8936 (poll), using Security Event Tokens, a JWT profile for representing an event. Adoption is the hard part: a signal is only useful if the receiving application acts on it, which means revoking a session rather than logging the event.
See also: CAEP, ITDR, JWT, Annabelle Backman
Related on Start with Identity
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- GlossaryAttack Path
A chain of individually legitimate permissions and relationships that together let a low-privileged identity reach a high-privileged one. Each link is a valid c
- GlossaryIdentity Resilience
The ability to keep authenticating and authorising legitimate users, and to recover the identity system itself, when the identity provider or directory is degra
- BlogOkta buys Permiso Security to put ITDR inside the identity provider
Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of
- BlogSilverfort acquires Fabrix Security, a one-year-old AI access-decision engine
Price undisclosed, reported as tens of millions for a company founded in 2025. Fabrix supplies the identity knowledge graph and decisioning; Silverfort supplies
- ExpertInventor of CAEP, co-chair of the Shared Signals working group
Atul Tulshibagwale invented the Continuous Access Evaluation Protocol at Google and co-chairs the OpenID Foundation's Shared Signals working group, which publis