Continuous authentication

Continuous authentication re-evaluates trust throughout a session instead of only at login, using signals that update in real time: carrier events, device posture, behavioral consistency. The premise is that identity assurance decays, a session valid at 9:00 may be hijacked by 9:05, so the decision to trust must be re-earnable and re-losable while work happens.

The hard part is not re-evaluating but acting on the result. A system that recomputes trust every minute and can only respond by ending the session has one blunt instrument; graduated responses, narrowing scope, requiring re-verification for the next sensitive action, need the application to have somewhere to put a reduced trust level.

The premise holds because a session is a bearer of authority that outlives the evidence that created it. Whatever was proven at login was proven then, and a token valid for eight hours carries that proof forward for eight hours regardless of what happened to the device, the credential or the phone line in the meantime.

Acting on a recomputed trust level requires the application to have a place to put it, and that is usually the missing piece rather than the evaluation. Systems that can only end a session will use that power sparingly, which means they mostly do nothing; systems that can narrow scope, lower a limit, or require re-verification before the next sensitive action can respond proportionately and therefore respond at all.

The standards work for getting the signal there mid-session is CAEP over the Shared Signals Framework, which exists precisely so a revocation observed in one system does not wait for another system's next token refresh.

The other requirement is that re-evaluation be cheap enough to run often. A check that costs a network round trip per request will be sampled or cached until it is effectively a login check again, so the design question is which signals are worth a live call and which can be pushed to the relying system as events when they change.