Identity standards are decided in comment periods that most practitioners never hear about until the specification is final. Three are open at the OpenID Foundation right now, and one significant framework has just been published in full.
Open for comment
OpenID Federation Extensions, closes 19 August
At implementer's draft review. Two extensions covering how changes involving subordinate entities are shared, and how organisations can retrieve large lists of entities within a federation.
Why it matters. If you operate in or consume a federation of any size, entity discovery and change propagation are the operational pain points. This is the mechanism that decides whether you find out about a subordinate change by polling or by being told.
OpenID Connect Key Binding, closes 23 August
At implementer's draft review. Aims to bind identity claims more closely to a cryptographic key, making it harder for a stolen token or credential to be reused.
Why it matters. This connects directly to the passkey story this fortnight. Strong authentication at the front door does not help if a valid token can be lifted and replayed somewhere else. Tighter binding closes that gap at the protocol level rather than the detection level.
OpenID Connect Ephemeral Subject Identifier 1.0, closes 15 September
At final specification review. Designed to stop a user's subject identifier being linked across multiple visits, making it harder for a relying party to track the same person between sessions.
Why it matters. Final specification review is the last call before this is fixed. If your consent, audit or entitlement logic quietly assumes a stable subject identifier per user per relying party, that assumption is about to become optional. Worth checking now rather than after a vendor turns it on.
Published and usable
Cloud Security Alliance AI Controls Matrix v1.1
Released in late June, with implementation guidance and a suggested rollout timeline now published alongside it. The framework contains 247 controls across 18 security domains and maps to standards including ISO 42001, the NIST AI Risk Management Framework and the EU AI Act.
Why it matters. This is the closest thing to a ready-made control set for AI systems, and a meaningful chunk of it lands on identity teams: agent credentials, delegated access, service account hygiene. If you are being asked what your AI controls are, this saves you inventing a framework from scratch.