Continuous Access Evaluation Protocol for Real-Time Access Control

I've been exploring how CAEP (Continuous Access Evaluation Protocol) enables identity systems to re-evaluate session risk in real time rather than on fixed intervals. The key technical shift is moving from static token lifetimes to event-driven enforcement. Two significant challenges:

1. Federated systems need standardized event schemas to ensure interoperability across IdPs and RPs.

2. Scalability—streaming identity events globally with low latency is non-trivial.

For those building distributed identity platforms, how are you handling real-time access revocation at scale without impacting user experience?