RBAC answers login. Agents need runtime access — and CAEP is how you pull the plug

Enterprises keep discovering the same uncomfortable gap. Ninety percent of organisations say they can see their AI footprint; nearly sixty percent still admit shadow AI sits outside governance. Both numbers cannot be true in the same operating model. The gap is where static role-based access quietly stops working.RBAC is not obsolete. It answers a human question well: what is this identity generally entitled to? Agentic systems ask a different question after authentication succeeds. An agent may keep working across tools, files, mail, and APIs long after the person who started the task has moved on. A shared service-account key or long-lived token baked into config makes “which agent did this” a logging guess rather than a proof.### What continuous access evaluation changesThe OpenID Continuous Access Evaluation Profile (CAEP), built on the Shared Signals Framework, exists so cooperating systems can push signed security events about sessions and credentials in near real time — session revoked, credential change, assurance-level change, device compliance change, risk-level change, and related signals. Instead of waiting for a token to expire, a receiver can attenuate or cut access That matters for agents more than for most human sessions. An agent’s useful lifetime is often a chain of tool calls. If policy only evaluated at login, every downstream action inherits yesterday’s trust. CAEP makes “stop this actor now” a first-class control plane event.### Standards that already fit the Outborn stackWorkload identity standards such as SPIFFE/SPIRE give each agent instance a short-lived, cryptographically verifiable identity instead of a shared static key. OAuth 2.0 Token Exchange (RFC 8693) can issue narrowly scoped tokens with an explicit actor claim when an agent acts on behalf of a user or another agent. CAEP then carries the kill and change signals across the systems that still hold live sessions.Mapped to Outborn products:- Outborn Account holds durable person and organisation identity at the door.- Outborn Agent Connect should broker scoped access from agent identities, not hand every agent the same provider credential.- Outborn Governance defines who may activate an agent, which resources it may touch, which actions need approval, and whether further delegation is allowed.- AppKit carries environment and lifecycle configuration for the applications those agents enter.- Outborn AI rem### The metric that mattersSecurity leaders do not need another framework diagram. They need one operational number: how quickly can they stop an autonomous agent once behaviour drifts? Shadow AI does not read the org chart. Runtime signals do.Organisations that wire identity, scoped delegation, and continuous evaluation together will treat agent autonomy as governed work. Organisations that only assign roles at login will keep discovering that the role was “correct” — and the access was still wrong.Teams building governed AI workflows can join the Outborn Account waitlist and learn about Outborn Account.ains the reasoning layer — not the authority layer.when the conditions of the original grant change.

Role-based access lists are often evaluated during login; real sessions also need to react to changes in device trust, account compromise and delegated authority. CAEP provides interoperable event semantics, but consuming applications still own enforcement decisions.

Have an employee's account disabled after a privileged agent task starts. Emit the appropriate event, then attempt the next tool call. Observe whether revoked authority is detected by the service performing the write.

Conceptual illustration for research and implementation planning.

Track subject correlation, signal delivery, policy propagation, effect on in-flight actions and recovery after mistaken revocation.

Primary source: Official documentation. The scenario is illustrative, not a record of a completed deployment test.