CAEP (Continuous Access Evaluation Profile)

CAEP is an OpenID standard for transmitting security events between identity systems while sessions are live: a session revoked here, a credential compromised there, delivered as signed security event tokens so that relying systems can react mid-session instead of at the next token refresh. It is the standards answer to the gap between issuing a session and learning it should die.

The gap CAEP addresses is the session already issued. Token lifetimes are a compromise between how often a client must refresh and how long a revoked session stays usable, and CAEP lets the second number be independent of the first by pushing the event instead of waiting for the refresh.

The events are signed tokens, so a receiver can verify the transmitter rather than trusting the connection, which matters because the whole point is acting on an instruction to end access.

The gap it addresses is the session already issued, and that gap is a deliberate compromise rather than an oversight. Token lifetimes balance how often a client must refresh against how long a revoked session stays usable, and every value chosen is wrong in one direction. Pushing the event decouples the two, so a short revocation window no longer costs a short refresh interval.

The events are signed tokens, which matters because the whole point is acting on an instruction to end access. A receiver verifies the transmitter rather than trusting the connection, and an unverified revocation instruction would be a denial-of-service primitive for anyone who could reach the endpoint.

Adoption is uneven, so a receiver usually consumes events from some sources and polls or waits for others. That mixed state is worth designing for explicitly rather than treating as temporary, since the systems that most need mid-session revocation are often the ones least likely to emit it. The transport underneath is the Shared Signals Framework, and building on it once is what makes adding a second transmitter cheap.

Acting on the events mid-session is what continuous authentication requires and what token lifetimes alone cannot provide.