Continuous Access Evaluation Protocol (CAEP) Sub-Second Session Revocation Standard

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Relying on Stateless JWT Expiration and Polling Instead of Cryptographically Verified CAEP Event Streams) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Continuous Access Evaluation Protocol (CAEP) Sub-Second Session Revocation Standard

--- description: Continuous Access Evaluation Protocol (CAEP) Sub-Second Session Revocation Standard - Enforces real-time push-based session invalidation and Continuous Access Evaluation Protocol (CAEP) Security Event Token (SET) processing across federated microservices. Mandates sub-millisecond local eviction cache lookups and cryptographically verified JWS SET ingestion to eliminate the revocation latency of stateless JWTs without relying on polling. globs: src/auth/**/*.{ts,tsx}, src/middleware/**/*.{ts,tsx}, src/security/**/*.{ts,tsx}, src/events/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/caep-sse-session-revocation-standard" --- # Continuous Access Evaluation Protocol (CAEP) Sub-Second Session Revocation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying on Stateless JWT Expiration and Polling Instead of Cryptographically Verified CAEP Event Streams ## System Constraints You are a Principal Security Architect enforcing RFC 9493 and OpenID Shared Signals and Events (SSE) / Continuous Access Evaluation Protocol (CAEP) standards. You must ensure all enterprise microservices implement immediate, push-based session revocation via cryptographically verified Security Event Tokens (SETs). Forbid any reliance on stateless JWT 'exp' lifetime alone or periodic HTTP polling for revocation checks. ## Strict Guidelines - Services MUST process CAEP Security Event Tokens (SETs) (RFC 8417) pushed over webhook or event streams and evict sessions within sub-second thresholds (<500ms). - Engineers MUST verify the JWS signature, issuer ('iss'), audience ('aud'), and event timestamp ('iat') of all incoming CAEP SETs using IdP-published JWKS keys before processing revocation payloads. - Engineers MUST deduplicate incoming SETs by checking the unique event identifier ('jti') against an ephemeral distributed cache to prevent event replay attacks. - Authentication middleware MUST perform an in-memory or sub-millisecond distributed cache (e.g., Redis cluster) lookup of revoked 'sub' (subject), 'sid' (session ID), or 'jti' identifiers on EVERY inbound request prior to downstream processing. - Services MUST NOT poll Identity Provider (IdP) introspection endpoints (/introspect or /userinfo) in request hot paths or periodic loops to detect credential revocation. - SET ingestion endpoints MUST support CAEP event types including 'https://schemas.openid.net/secevent/caep/event-type/session-revoked' and 'https://schemas.openid.net/secevent/caep/event-type/credential-change'. ## Bad vs Good Implementations ### CAEP SET Processing and Revocation Middleware Integration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The middleware completely relies on the JWT's static expiration timestamp ('exp') and signature, ignoring real-time token compromises. The polling mechanism introduces a 60-second window of vulnerability where compromised credentials can be actively exploited, and poll spikes risk cascading failures on the IdP. ```typescript import { Request, Response, NextFunction } from 'express'; import jwt from 'jsonwebtoken'; // ANTI-PATTERN: Blindly trusting valid unexpired JWTs without CAEP revocation verification, // and using periodic HTTP polling for revocation checks which leaves minutes of replay vulnerability. export async function authenticateUser(req: Request, res: Response, next: NextFunction) { const token = req.headers.authorization?.replace('Bearer ', ''); if (!token) return res.status(401).json({ error: 'Missing token' }); try { // Relies purely on signature and exp claim; vulnerable if credentials/tokens are compromised const decoded = jwt.verify(token, process.env.JWT_PUBLIC_KEY!) as { sub: string; exp: number }; req.user = decoded; return next(); } catch (err) { return res.status(401).json({ error: 'Invalid token' }); } } // Flawed polling attempt: causes high load and unbounded latency setInterval(async () => { const response = await fetch('https://idp.enterprise.internal/oauth/revocations'); // Stale array in memory; high window of compromise }, 60000); ``` #### Production Standard (Correct) > **Standard**: The solution implements standard-compliant CAEP webhook ingestion. Incoming Security Event Tokens (SETs) are cryptographically validated against the IdP's JWKS, checked for replay attacks via 'jti', and mapped into an eviction cache. Authentication middleware checks revoked subjects and session IDs in sub-millisecond O(1) Redis lookups, enforcing real-time revocation without polling. ```typescript import { Request, Response, NextFunction } from 'express'; import { createRemoteJWKSet, jwtVerify } from 'jose'; import Redis from 'ioredis'; const redis = new Redis(process.env.REDIS_URL!); const IDP_JWKS = createRemoteJWKSet(new URL('https://idp.enterprise.internal/.well-known/jwks.json')); const EXPECTED_ISSUER = 'https://idp.enterprise.internal'; const EXPECTED_AUDIENCE = 'urn:enterprise:api:gateway'; const CAEP_REVOCATION_EVENT = 'https://schemas.openid.net/secevent/caep/event-type/session-revoked'; interface CaepSecurityEventToken { events: { [key: string]: { subject: { format: string; sub?: string; iss?: string; sid?: string }; event_timestamp?: number; reason_admin?: string; }; }; } // Push-based CAEP Receiver Endpoint: Ingests Security Event Tokens (SETs) export async function handleCaepWebhook(req: Request, res: Response) { const rawSet = req.body; try { // 1. Verify JWS signature, issuer, and audience per RFC 8417 const { payload } = await jwtVerify(rawSet, IDP_JWKS, { issuer: EXPECTED_ISSUER, audience: EXPECTED_AUDIENCE, clockTolerance: 5, }); const jti = payload.jti; if (!jti || !(await redis.set(`set:jti:${jti}`, '1', 'EX', 86400, 'NX'))) { return res.status(400).json({ error: 'Duplicate or missing SET JTI' }); } // 2. Extract CAEP session-revoked event const caepEvents = (payload as unknown as CaepSecurityEventToken).events; const revocation = caepEvents[CAEP_REVOCATION_EVENT]; if (revocation) { const { sub, sid } = revocation.subject; const pipeline = redis.pipeline(); const ttlSeconds = 7200; // Match max token lifetime if (sid) pipeline.set(`revoked:sid:${sid}`, '1', 'EX', ttlSeconds); if (sub) pipeline.set(`revoked:sub:${sub}`, '1', 'EX', ttlSeconds); await pipeline.exec(); } return res.status(202).send(); } catch (err) { return res.status(400).json({ error: 'Invalid Security Event Token' }); } } // Authenticate Request: Zero-trust O(1) CAEP revocation verification export async function authenticateUser(req: Request, res: Response, next: NextFunction) { const token = req.headers.authorization?.replace('Bearer ', ''); if (!token) return res.status(401).json({ error: 'Missing token' }); try { const { payload } = await jwtVerify(token, IDP_JWKS, { issuer: EXPECTED_ISSUER, audience: EXPECTED_AUDIENCE, }); // Sub-millisecond revocation lookup const isRevoked = await redis.mget( `revoked:sid:${payload.sid}`, `revoked:sub:${payload.sub}` ); if (isRevoked[0] !== null || isRevoked[1] !== null) { return res.status(401).json({ error: 'Session invalidated by CAEP security policy' }); } req.user = payload; return next(); } catch { return res.status(401).json({ error: 'Invalid or expired token' }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Continuous Access Evaluation Protocol (CAEP) Sub-Second Session Revocation Standard

Continuous Access Evaluation Protocol (CAEP) Sub-Second Session Revocation Standard defines an industrial-grade behavioral standard for security engineering. Enforces real-time push-based session invalidation and Continuous Access Evaluation Protocol (CAEP) Security Event Token (SET) processing across federated microservices. Mandates sub-millisecond local eviction cache lookups and cryptographically verified JWS SET ingestion to eliminate the revocation latency of stateless JWTs without relying on polling. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Stateless JWT Expiration and Polling Instead of Cryptographically Verified CAEP Event Streams Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Stateless JWT Expiration and Polling Instead of Cryptographically Verified CAEP Event Streams	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST process CAEP Security Event Tokens (SETs) (RFC 8417) pushed over webhook or event streams and evict sessions within sub-second thresholds (<500ms).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.