Real-Time Risk Signals for AI Agent Authorization

An AI agent can pass every check at session start and still go rogue mid-session — reading hundreds of records in seconds when the baseline is a handful per minute — while a static authorization system remains oblivious, since it only evaluates context at login, not during execution. The OpenID Shared Signals Framework (SSF), using CAEP and RISC event profiles, closes this gap by streaming signed Security Event Tokens (SETs) from transmitters like the agent runtime, identity provider, and EDR system to a risk engine.

The risk engine maintains a per-agent risk score, updates it as events arrive, and invalidates the PDP's cached decision context so the next authorization check reflects current risk rather than stale, session-start conditions. When the score crosses a defined threshold, the system can automatically trigger session revocation — collapsing the time from anomaly detection to full lockout to mere seconds.

For engineers, the key takeaway is that per-invocation policy evaluation alone isn't enough; the context being evaluated must also update in near-real-time. Custom agent-specific signals (like anomalous-behavior or privilege-escalation-attempt) can be defined under a vendor namespace, and delegated sub-agents can inherit their parent's risk context automatically.