---
title: "Listen for security signals from the · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/shared-signals
updated: 2026-10-20
licence: "All rights reserved"
---

# Listen for security signals from the customer's provider

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning)
- Rule: Receive OpenID Shared Signals events from customers' identity providers, and end sessions when they report a revoked session or a disabled account.
- How: The OpenID Foundation made the Shared Signals Framework, CAEP and RISC final, each as 1.0, in September 2025. Publish a receiver and set up one stream per organisation, with push delivery as in RFC 8935 or polling as in RFC 8936. Verify each Security Event Token, a signed JWT defined in RFC 8417, as [verify every token](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/token-checks) says. On a CAEP `session-revoked` or a RISC `account-disabled` event, run [deprovision](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/deprovision).
- Check: Send a signed test `session-revoked` event for a signed-in test user. Their next request answers 401. The same event with a bad signature changes nothing.

Example:

```json
{
  "iss": "https://idp.acme.example",
  "aud": "https://example.com/ssf",
  "iat": 1793606400,
  "jti": "4d3559ec67504aaba65d40b0363faad8",
  "sub_id": { "format": "email", "email": "ana@acme.example" },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/session-revoked": { "event_timestamp": 1793606390 }
  }
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/shared-signals`.

- Previous: [Map directory groups to roles](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/group-role-mapping)
- [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning)