How Shared Signals Can Enable Near-Real-Time Zero Trust Access Decisions

Summary

The article explains how OpenID’s Shared Signals Framework and Continuous Access Evaluation Profile can propagate changes in account, device, and risk status so services can update access decisions without checking an identity provider on every request.

Key points

• Long-lived access tokens can remain valid after a user's or agent's account, device status, risk, or access needs change.
• Checking with the identity provider on every request can impose substantial load, while very short-lived tokens can degrade user experience.
• The article proposes evaluating each request at a policy enforcement point using locally available, asynchronously updated data.
• The OpenID Shared Signals Framework uses signed Security Event Tokens to communicate security changes between systems.
• The Continuous Access Evaluation Profile defines events such as session revocation, device-compliance changes, credential changes, and risk-level changes.
• The article says providers including CrowdStrike and Zscaler have demonstrated access decisions based on CAEP events.

Vendors