Propose New Signals

Our MagicEndpoint is using CAEP for both security and a smoother experience for the user. We also took part in the Shared Signals interop at Gartner in 2024, so we've worked with these mechanisms in practice.

I'd like to propose some new signals and ask the group one question about user experience.

The signals are:
• the endpoint is powered on or off
• the user is logged on or off
• the screen is locked
• and possibly more from the endpoint later

These are simple facts. But if the receiver can see them, some attacks stop right away. When a request arrives with a valid token but the endpoint is off, it's an attack. Same if the user has logged off.

The screen lock is the one that adds complexity. A locked device should keep receiving email, for example. But a new request that needs the user present should be refused.

These signals work like device-compliance-change — a two-way state change. It's a small addition to the existing signal types. But it may carry more implications for receivers.

That leads to my question: when the user returns and logs in again, will the session continue without a new sign-in — or even continue where it left off? I understand the response is up to the receiver, the SP. I'd value the group's thinking.

No files, tests, or entry points are named. Start by reading the existing CAEP and device-compliance-change signal definitions; the proposal is complete only when the group agrees on the new signal types, their receiver semantics, and the session behavior after the user returns.