Global – October 12, 2026 -- Re-validating an access token at every request would multiply the load on an identity provider (IdP) by roughly 1,000x, assuming a 24-hour token is used 1,000 times. That figure is why the OpenID Foundation's Shared Signals Framework (SSF) is gaining traction as the mechanism for keeping Zero Trust access decisions current.
Short-lived tokens cut IdP load to about 24x but degrade user experience
Shortening a token's life from 24 hours to one hour raises IdP burden by only about 24x. Users, however, face repeated redirects to the IdP and back, which degrades the experience. Neither approach lets an organization instantly revoke access after a termination or rogue agent activity, or react when device or task conditions change while a token is still valid.
Authorization data sits in at least six separate systems
A valid access decision depends on data held in different places: account status in the IdP directory, device incidents in the extended detection and response (XDR) system, and compliance data in mobile device management (MDM). Task information sits in tools such as ServiceNow or Jira, leave data in the HR system, and on-duty schedules in tools such as PagerDuty.
The proposed architecture delivers changes asynchronously and reliably to the systems that need them. Each access request is then evaluated against locally available data at a policy enforcement point, which can be externalized from the application code.
OpenID Foundation spent 6+ years building SSF on IETF-standard tokens
SSF delivers Security Event Tokens (SETs), an IETF standard. SETs are JWTs signed by SSF transmitters and verified by receivers, and both sides know which events were delivered. Because delivery is asynchronous, propagation is near real time rather than instantaneous.
The Continuous Access Evaluation Profile (CAEP) defines four event types: session revoked, device compliance change, credential change and risk level change. Other SSF-based profiles include Risk Incident Sharing and Coordination (RISC) for account security events and SCIM Events for account changes.
Apple, Google, Okta and CrowdStrike have implemented SSF and CAEP
Apple, CrowdStrike, Google, IBM, Jamf, Okta, SailPoint and Zscaler have implemented the standards in their products. CrowdStrike and Zscaler recently demonstrated Zero Trust access in which CAEP events based on CrowdStrike-detected device incidents determine access to cloud services through Zscaler in near real time.
The same foundation applies to AI agents performing privileged tasks, whose access must also react to changing conditions. Security and identity vendors, SaaS providers, cloud providers and managed service providers are being asked about SSF and CAEP support.