Continuous access evaluation
A token that lasts an hour is an hour of access after you pressed revoke. Shared Signals (CAEP and RISC) fix that: LumoAuth sends a signed event to every application and MCP server the moment something changes, and accepts the same events from Okta, Google and other providers.
Token lifetime is not a revocation strategy
Short tokens hurt performance; long tokens leave a window. When an employee is terminated or a laptop is stolen, "it expires in an hour" is not an acceptable answer.
How LumoAuth solves it
Send events
Session revoked, credential changed, device compliance changed, token claims changed, assurance level changed. Pushed to receivers or polled. Docs
Receive events
Subscribe to streams from other identity providers and react: end sessions, require re-authentication. Docs
MCP servers and agents
Revoking an agent sends an event to the MCP servers it was connected to. Docs
Device posture as a signal
CrowdStrike, Intune, Jamf and Kandji changes can end sessions. Docs
Back-channel logout
For plain OpenID Connect apps, logout notifications reach every application at once. Docs
Setting it up
Create a stream
AI Agents → Security signals → Create stream; pick the event types and the receiver.
Verify events in the receiver
Signed security event tokens; the docs show the verification.
Subscribe to upstream providers
Add a receiver for your workforce identity provider's stream.
Standards involved
Plain names on the left, the specification on the right. The full map is in the standards reference.
- Shared Signals Framework
- OpenID SSF 1.0
- CAEP and RISC
- OpenID CAEP 1.0, RISC 1.0
- Security event tokens
- RFC 8417, 8935, 8936, 9493
- Logout
- OIDC back-channel logout
Which plan you need
Back-channel logout and token revocation are on every plan. Shared Signals in and out, and device posture, are on Business.
Documentation
Questions
Which providers send CAEP events today?
Ship passwordless sign-in this week. Put guardrails on your agents today.
The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.