ZipPigeon technical whitepaper Updated Aug 2, 2026 3 min read

Bind the signal source and subject

The agent sponsor binds an exact transmitter issuer, iss_sub identity, public JWKS URL, audience, and per-event behavior. The server creates a dedicated stream endpoint for that binding. Replacing a binding changes the trust relationship deliberately instead of letting an incoming event choose its own source or target.

PUT /api/service-accounts/:id/shared-signals
POST /api/shared-signals/:streamId/events
DELETE /api/service-accounts/:id/shared-signals

Map each risk event to an action

Supported CAEP events include session revocation, credential change, assurance-level decrease, and device noncompliance. Configure each event as audit-only, access revocation, or suspension based on the identity provider signal and the workload risk. Assurance increases and compliant-device events are recorded but never resume an agent automatically.

  • Audit-only: retain the validated security event without changing agent access.
  • Access revocation: invalidate current credentials and outstanding delegated grants.
  • Suspension: revoke current access and prevent new use until a sponsor explicitly resumes the agent.

Validate every security event token

The stream accepts a signed application/secevent+jwt token only from its bound transmitter. Validation covers the configured algorithm and public key, exact audience, expected subject format, one allowlisted event, bounded event age, and unique issuer/JTI pair so a captured signal cannot be replayed.

POST /api/shared-signals/:streamId/events
content-type: application/secevent+jwt

<signed Security Event Token from the bound transmitter>

Resume through a human decision

A positive signal does not silently restore trust after suspension. The sponsor must complete recent verification and call the resume action. Previously revoked static, workload, or MCP credentials and outstanding grants remain revoked, so the workload must obtain new eligible credentials after the sponsor restores the principal.

POST /api/service-accounts/:id/resume
# Browser session plus recent step-up verification required.

Benefits and use cases

Continuous signals close part of the gap between credential issuance and later identity risk. They are useful when an enterprise identity provider detects a revoked session, rotated credential, reduced assurance, or noncompliant device after an agent has already obtained short-lived access.

  • Incident containment: suspend the agent when its bound identity session is revoked.
  • Credential hygiene: invalidate grants when the upstream workload credential changes unexpectedly.
  • Device posture: prevent new use after a noncompliance event while preserving an auditable reason.

Know the remaining boundary

A security event can stop new service-mediated access, but it cannot recall a live retrieval capability or plaintext already decrypted in the customer workload. Keep capability lifetimes short, minimize artifact sets, isolate agent execution, and treat signal-driven revocation as one control in a broader response plan.

  • Signal delivery must be monitored; a transmitter that never sends an event cannot change access.
  • Use rate limits and sanitized audit records around the public event receiver.
  • Test each identity-provider event mapping before using suspension in a critical workflow.