Skip to main content
Agent Identity

OIDF · Final (SSF 1.0)

OpenID Shared Signals Framework 1.0

openid-sharedsignals-framework-1_0

OIDF FinalStableAuthenticationAdjacent

An agent holding a delegated token after the user is fired, phished, or offboarded is a standing incident. SSF/CAEP is how the IdP tells the agent platform to drop the session.

At a glance

Problem
Once a session or credential is compromised, every relying party that accepted it needs to hear quickly. SSF profiles Security Event Tokens (RFC 8417) for stream-based sharing between transmitters and receivers. RISC is the account-compromise profile; CAEP is the session/access profile.
Identity / authn / authz
Continuous evaluation of authentication and session risk, not initial login.

Actors

  • Transmitter (IdP, device vendor, …)
  • Receiver (SaaS, agent platform)

When this matters for agents

When this matters for agents: an agent holding a delegated token after the user is fired, phished, or offboarded is a standing incident. SSF is how the IdP tells the agent platform to drop the session. Not an identity protocol for the agent itself.

Flow in plain language

Receiver discovers transmitter configuration, manages an event stream, and consumes SETs via push (RFC 8935) or poll (RFC 8936). Events name subjects using RFC 9493 subject identifiers.

Key tokens and claims

Security Event Token
JWT wrapping an events object with typed event URIs.

Implementer notes

Implement SSF before inventing webhook-based 'session revoked' APIs. RISC remains the account-takeover event set; CAEP covers session-revoked, credential-change, device-compliance-change.

Relationship to others

Primary sources