Keycloak’s experimental Shared Signals transmitter shows identity platforms catching up to continuous access

Identity platforms are starting to ship the plumbing continuous access evaluation needs. In July 2026, Keycloak announced experimental support for the OpenID Shared Signals Framework (SSF) 1.0 as a transmitter in nightly builds — mapping native login, logout, credential-change, and session-revocation events into CAEP and related security event tokens that subscribed receivers can consume.That is a practical industry tell. For years, continuous access evaluation lived mostly in standards text and specialised brokers. When a widely deployed open-source IdP can push signed session-revoked and credential-change events over a standard wire format, application platforms no longer have an excuse to treat access as a one-time login decision.### Why this matters beyond KeycloakSSF is the transport. CAEP is the vocabulary for “something changed about an ongoing session or credential.” Receivers that understand those events can re-authenticate, reduce privileges, or terminate sessions without waiting for token expiry. Keycloak’s early transmitter support also bundles interop considerations such as legacy SSE CAEP profiles used in some enterprise device fleets — a reminder that real deployments aFor product teams, the architectural question is not “will we replace our IdP tomorrow?” It is whether your application identity layer can:1. Represent subjects consistently (people, organisations, and eventually agents).2. Accept upstream change signals without inventing a private webhook dialect for every vendor.3. Propagate revocation into the applications and tools that still hold live context.### Outborn’s readOutborn Account is the continuity layer between a person, their organisation memberships, and approved applications. As IdPs and federation stacks grow SSF/CAEP transmitters, Account and AppKit should be designed as good citizens in that network — able to react when assurance drops, credentials rotate, or a session is revoked upstream.Outborn Governance and Agent Connect then extend the same idea to agentic work: a revoked or narrowed human session should not leave an agent holding yesterday’s authority, and an agent identity shoThe competitive bar is rising quietly. Continuous access is becoming a platform feature, not a consulting slide. Identity products that only mint tokens at login will feel incomplete next to stacks that can also take access away when reality changes.Teams building continuous-access-ready identity can join the Outborn Account waitlist and learn about Outborn Account.uld be equally subject to kill and scope changes.re messy and standards adoption is incremental.

Shared Signals can move a security event between products, but a transmitter alone does not prove that a relying party changes an active session. The operational chain includes event creation, trusted delivery, mapping to a session, local policy and a measurable enforcement result.

Revoke a privileged session in the source identity system. Confirm the receiving application recognizes the event subject and blocks further privileged operations without waiting for the original token to expire.

Conceptual illustration for research and implementation planning.

Measure end-to-end revocation latency, delivery retry loss, subject-mapping failures and events that were acknowledged but not enforced.

Primary source: Official documentation. The scenario is illustrative, not a record of a completed deployment test.