Week ending July 31, 2026

The most useful thing this week is the OpenID Foundation moving its CAEP Interoperability Profile into final-specification review — a profile whose entire job is to pin down what two implementations of the Shared Signals Framework must agree on before either can claim to interoperate. Shared Signals has never lacked backers, but it has had no test that distinguishes a working interop from a claim of support. A conformance profile provides one.

Standards in motion

A conformance profile for Shared Signals, moved to final review. The OpenID Foundation opened the 60-day public review on July 27 for the OpenID CAEP Interoperability Profile 1.0, the last procedural step before a member vote makes it a Final Specification. The Shared Signals Framework and its Continuous Access Evaluation Profile let one system tell another, in near-real-time, that a session it relied on should no longer be trusted — a token was revoked, a device fell out of compliance, a risk signal fired. The framework has been published for years and has real implementers; the profile adds which SSF endpoints are required, how OAuth 2.0 authorizes them, and the specific event set two parties must both handle before a cross-vendor deployment can be said to work. Adoption read: nothing to deploy against yet — this is a review upstream of the final vote, which closes September 25 with a member vote to follow — and the signal to watch is whether an interop or certification program attaches to the profile once it is final. Worth noting who wrote it: the named authors sit at CrowdStrike and Okta, two of the larger session-security implementers — the people with the most deployed CAEP are the ones defining what conformance means, rather than each holding a private interpretation.

RCS Universal Profile 4.1. The GSMA published Universal Profile 4.1 on July 28, and unlike the 4.0 release earlier this year it ships almost no new consumer features. What it does instead is harden the substrate: a refinement of the end-to-end encryption specification, granular controls over who can see a user’s profile details, and a move of messaging and signaling onto an optimized gRPC transport. Universal Profile is the open, multi-carrier specification that keeps RCS a portable messaging standard rather than a set of per-operator islands. The privacy property here is real but modest: profile-visibility controls put a data-minimization decision in the user’s hands, and the E2EE refinement continues work whose default-on story is still incomplete across the ecosystem. Adoption read: the profile is published; uptake runs on the usual RCS clock, which is the carriers and the handset messaging clients, and the thing to watch is how quickly the E2EE refinements actually ship default-on rather than as an option a client may or may not enable.

Implementations & adoption

C2PA adds a platform-scale adopter to its steering committee. The Coalition for Content Provenance and Authenticity announced on July 27 that TikTok upgraded from general member to steering-committee member of C2PA, the open standard for attaching verifiable provenance to media. The read is adoption reach, not a spec move: a steering-committee seat is governance influence, and a platform operating provenance labeling at consumer scale is now helping steer the technical direction rather than only consuming the output. The value of Content Credentials is a function of where signed content actually travels, and the largest distribution surfaces are exactly where it has been thinnest. The caveat is the standing one for this standard: C2PA is open and its specification is public, but it is backed heavily by a small number of very large platforms, and every addition of a platform-scale steering member is worth reading on the interoperable↔captured axis as well as the adoption one. The thing to watch is whether the specification’s direction stays implementable by parties who are not on the committee. On the record so far this is a straightforward adoption gain for an open standard.

Capital & motivation

No round this week reveals more than the authorship line already does. The CAEP Interoperability Profile is being carried to final review by engineers at CrowdStrike and Okta — the implementers with the most deployed Shared Signals — which is positioning through specification work rather than through a deal. The incumbents with the most CAEP in production are investing in a shared conformance target rather than a set of private ones.