shared-signals.dev

Working group

The Shared Signals Working Group

SSF, CAEP and RISC are written by the Shared Signals Working Group of the OpenID Foundation. It works in the open: anyone can read the drafts, the mailing list and the meeting notes, and anyone who signs the Foundation’s contribution agreement can take part.

Meetings

Every Tuesday, 10:00 Pacific / 13:00 Eastern

On Zoom. The join link, a calendar file and notes from every call are on the wiki.

Mailing list

openid-specs-risc@lists.openid.net

Subscribe to follow along, or read the archives. The list kept its name from the RISC days.

Repository

openid/sharedsignals

Spec sources, issues and pull requests. Working copies are published at openid.github.io/sharedsignals.

What it does

From the charter, the working group exists to let related systems share security events, state changes and other signals so that they can:

  • manage access and enforce access control across distributed services in a dynamic environment;
  • stop attackers from turning one compromised account, device, service or endpoint into access to others; and
  • help users, administrators and service providers coordinate to detect and respond to incidents.

In scope: a taxonomy of security events, the privacy implications of sharing them, the transport and stream management mechanisms, trust frameworks, account recovery signals, and implementation best practice. Out of scope: rating account reputation, and building centralised clearinghouses for security events.

What it publishes

SpecificationStatusEditors
Shared Signals Framework (SSF) 1.0FinalAtul Tulshibagwale, Tim Cappalli, Marius Scurtescu, Annabelle Backman, John Bradley, Shayne Miel, Steve Venema, Apoorva Deshpande, Sean O’Dell, Jen Schreiber, Tushar Raibhandare, Yair Sarig
Continuous Access Evaluation Profile (CAEP) 1.0FinalTim Cappalli, Atul Tulshibagwale, Apoorva Deshpande
Risk Incident Sharing and Coordination (RISC) 1.0FinalMarius Scurtescu, Annabelle Backman, Phil Hunt, John Bradley, Stan Bounev, Atul Tulshibagwale
CAEP Interoperability Profile 1.0Proposed Final, under revisionAtul Tulshibagwale, Apoorva Deshpande, Jen Schreiber

See Specs for what each one covers and where it stands.

Chairs

  • Mike Kiser (SailPoint)
  • Sean O’Dell (CVS Health)
  • Atul Tulshibagwale (CrowdStrike)

How to take part

  1. Follow along. Subscribe to the mailing list and watch the GitHub repository. Reading costs nothing and needs no agreement.
  2. Sign the contribution agreement. Posting to the list, joining the calls as a participant and contributing text require the OpenID Foundation’s contribution agreement, which covers the IPR policy. You can sign as an individual or on behalf of your organisation. OpenID Foundation membership is not required.
  3. Join a call. Every Tuesday, 10:00 Pacific / 13:00 Eastern; details on the meetings page. Agendas usually cover open issues and pull requests, interop planning and new profiles.
  4. Open an issue or pull request on openid/sharedsignals.
  5. Bring an implementation to an interop. The working group runs interoperability events, usually alongside identity conferences; they are announced on the mailing list.

Interop events

Who took part in each is on the Implementations page.

History

The group began as the RISC (Risk Incident Sharing and Coordination) working group, focused on account security events between providers. In 2019 it was re-chartered with a wider scope as Shared Signals and Events, taking in Google’s CAEP proposal for continuous access evaluation alongside RISC, and later became the Shared Signals working group. SSF 1.0, CAEP 1.0 and RISC 1.0 were approved as Final Specifications in 2025.

This is an independent summary. If anything here disagrees with openid.net, openid.net is right — and please tell us.