Issues

• Describe SSF metadata requirements by WISE

  openid/ssf-wise-profile#46 · Filter by author identitymonk opened on Oct 6, 2026

• Trust anchor and federation events should be informational and shouldn't be able to establish trust on their own

  openid/ssf-wise-profile#45 · Filter by author appsdesh opened on Oct 4, 2026

• trust_domain duplicates sub_id on trust and federation events (2.6.1 to 2.6.6)

  openid/ssf-wise-profile#44 · Filter by author appsdesh opened on Oct 4, 2026

• Make trust anchor identifiers REQUIRED (2.6.1 to 2.6.3): an ambiguous anchor revocation can take down a whole trust domain

  openid/ssf-wise-profile#43 · Filter by author appsdesh opened on Oct 4, 2026

• (4.4) compromise response lets any Transmitter trigger immediate revocation or isolation, which opens a denial-of-service vector

  openid/ssf-wise-profile#42 · Filter by author appsdesh opened on Oct 4, 2026

• Add optional tracking_id and expected_resolution to workload-vulnerability-status-changed to support audits and remediation planning

  openid/ssf-wise-profile#41 · Filter by author appsdesh opened on Oct 4, 2026

• under_investigation on workload-vulnerability-status-changed needs a defined way to be resolved

  openid/ssf-wise-profile#40 · Filter by author appsdesh opened on Oct 4, 2026

• What is the point of sending pending? Only send terminal posture evaluation status on workload-baseline-changed

  openid/ssf-wise-profile#39 · Filter by author appsdesh opened on Oct 4, 2026

• Make credential identifiers REQUIRED on credential lifecycle events (2.4.1 to 2.4.5)

  openid/ssf-wise-profile#38 · Filter by author appsdesh opened on Oct 4, 2026
  1

• Make provenance_uri REQUIRED on workload-provenance-changed

  Evaluating
  openid/ssf-wise-profile#37 · Filter by author appsdesh opened on Oct 4, 2026
  1

• Add policy_id to posture-evaluation-failed and posture-evaluation-succeeded, and add reason to posture-evaluation-succeeded

  Evaluating
  openid/ssf-wise-profile#36 · Filter by author appsdesh opened on Oct 4, 2026
  1

  

• Combine the three policy-changed events (2.7.1 to 2.7.3) into one policy-changed event with a policy_type attribute

  Draft-04
  openid/ssf-wise-profile#35 · Filter by author appsdesh opened on Oct 4, 2026
  1

  

• workload-degraded and workload-restored express an authorization outcome, not a lifecycle state. Consider removing them

  wontfix
  openid/ssf-wise-profile#34 · Filter by author appsdesh opened on Oct 4, 2026
  6

  

• Add a workload-observed event to mark the start of a workload's lifecycle

  Draft-04
  openid/ssf-wise-profile#33 · Filter by author appsdesh opened on Oct 4, 2026
  1

  

• WISE effective_at claim discrepancy

  Draft-04
  openid/ssf-wise-profile#32 · Filter by author appsdesh opened on Oct 3, 2026
  1

  

• Rework trust_level definition and values

  openid/ssf-wise-profile#31 · Filter by author identitymonk opened on Sep 28, 2026
  4

• Make previous_trust_level a REQUIRED field

  openid/ssf-wise-profile#30 · Filter by author identitymonk opened on Sep 28, 2026
  4

• Rationalization of WISE event

  openid/ssf-wise-profile#29 · Filter by author identitymonk opened on Sep 28, 2026
  3

• Register Reason value as urn in a registry

  openid/ssf-wise-profile#28 · Filter by author identitymonk opened on Sep 28, 2026

• Better accommodate inbound signals from External Providers (CNAPPs, Posture Evaluators, etc)

  openid/ssf-wise-profile#24 · Filter by author dagdagdag83 opened on Jul 29, 2026
  2