The group will define:

Security events

• These are events – whether directly authentication or authorization-related or occurring at another time – that one party becomes aware of and that may have security implications for other parties.

State Updates

• These are updates that reflect state changes at one party that may have impact on the resource access decisions at other parties.

Taxonomy

• The group will develop a taxonomy of security events and state updates and a common set of semantics to express relevant information about a security event or state update, and recommended actions to take in response to an event or update.

Privacy implications

• Sharing security or state information amongst providers has potential privacy implications for both end users and service providers. These privacy implications must be considered against both (a) applicable regulations, policies, and the principles of user notice, choice and consent, and (b) the recognized benefits of protecting users’ accounts and data from abuse. The group will consider ways to address such potential privacy implications when defining mechanisms to handle the various security events or state updates and recommend best practices for the industry.

Communications mechanisms

• The group will define bindings for the use of existing transport and event stream management protocols defined elsewhere, and define new protocols as needed to meet technical requirements identified by the group.

Trust frameworks

• The group will define at least one model for the conditions under which information would be shared.

Best practices

• Where specifications allow for a wide range of implementations, the group will provide recommended best practices on how to implement specifications safely and securely, and how to mitigate known threats.

Out of scope:

• Determining or issuing statements regarding the reputation or quality of a user.
• Definition of APIs and underlying mechanisms for connecting to, interacting with and operating centralized databases or intelligence clearinghouses when these are used to communicate security events between account providers.