EUDI Wallets: A Shift in External Identity Governance?

European Digital Identity and the changing partner lifecycle

As Europe moves into 2027, digital identity architecture is entering an interesting phase. EU Member States are introducing EUDI personal wallets, while the European Business Wallet continues through the legislative process.

The Business Wallet is particularly relevant from an IAM perspective because it introduces concepts around organisational identity, representation and delegated authority. For IGA architects, this raises an interesting question: what happens to one of the sometimes less elegant areas of workforce identity — partner identity lifecycle management?

A classic external user process today might look like:

Sponsor → partner record / Entra guest → IGA role / access → periodic review → expiry

The receiving organisation usually has to establish much of the identity context itself: who the consultant is, which partner they represent, which project they are associated with and how long that relationship should remain valid.

The same governance challenge increasingly applies also to AI agents. They are, in effect, visa-free digital migrants that can cross organisational boundaries and act on behalf of other identities or organizations without the traditional constraints that apply to people.

Because the organisation rarely has direct visibility into an external person's employment or representation status, stale external identities are managed through mechanisms such as sponsors, expiry dates and recurring certifications.

This differs from internal employee identity governance, where HR normally provides a relatively strong authoritative lifecycle source. Partner lifecycle management might be delegated to sponsoring or external managers through IGA portals or My Staff-type tools, but it usually relies on manual effort.

European Digital Identity may gradually change this input model by adding another source of trusted evidence. Instead of recreating all identity and relationship information internally, an enterprise could consume independently verifiable evidence.

A partner employee could, for example, present a verified identity together with evidence that they represent Company A and hold a mandate related to Project X:

PID + organisational credential / mandate → verification → IGA policy → Entra / application access

The wallet therefore reinforces the need for robust IAM and IGA. These systems remain part of the underlying infrastructure for governance, lifecycle management and policy enforcement.

The more interesting change may occur after onboarding.

Suppose the consultant's mandate for Project X is later revoked. In current environments, that change might only be discovered through the next reconciliation cycle, sponsor review or expiry process. If access was originally granted because of external evidence that is no longer valid, there is a reasonable argument that the corresponding access should also be quickly recalculated.

This is where the OpenID Shared Signals Framework (SSF) and Continuous Access Evaluation Profile (CAEP) become relevant.

SSF and CAEP became final OpenID specifications in 2025 and define a standard transmitter/receiver model for communicating changes in identity or security state. CAEP 1.0, for example, defines a Credential Change event and includes verifiable-credential as a credential type, with change types such as create | update | revoke | delete

This does not imply that EUDI wallets or credential status services directly emit CAEP events. However, SSF provides an interesting standards-based mechanism through which changes in external trust could potentially reach enterprise IAM and IGA systems.

Microsoft Entra Continuous Access Evaluation (CAE) for Microsoft ecosystem services is based on OpenID CAEP concepts. Tim Cappalli, formerly with Microsoft and currently with Okta, is a co-author of both the SSF and CAEP specifications.

However, Entra is not currently documented as a general-purpose SSF receiver endpoint for externally generated credential events. Okta on the other hand does expose a documented SSF Receiver API for signals from third-party transmitters.

This distinction is important: EUDI includes privacy-preserving credential status checking, while IGA may need to react when previously trusted evidence becomes invalid. A trust or integration service could detect such a change and translate it into an SSF/CAEP event for downstream governance.

The IGA challenge is not merely receiving the revocation signal. It is understanding which access depended on the revoked evidence. If Alice's Project X mandate is revoked, disabling Alice's complete partner identity may be inappropriate. There are at least two possible patterns.

A traditional state-based model works well where an attribute or relationship change causes policy to be re-evaluated. A revocation signal could trigger a refresh from an authoritative mandate source, update Alice's representation or relationship state, and allow the IGA policy engine to recalculate access.

An event-driven model could instead use the revocation signal to trigger removal of entitlements known to depend on that particular mandate. This could enable faster response, but requires some form of evidence-to-entitlement dependency mapping.

The identity security market is moving toward more event-driven architectures. Major IGA vendors such as SailPoint and Saviynt have publicly shown SSF receiver or CAEP-style capabilities, with interoperability implementations demonstrating both push and polling delivery models.

A related architectural shift can be seen in Saviynt's recently launched Zuma, which combines an access graph with Intent-Aware Runtime Authorization, evaluating identity, context, risk, policy and intent at runtime, while MCP capabilities allow authorized agents to query identity data and initiate governance actions using natural language.

The direction is therefore becoming visible: periodic identity reconciliation may increasingly be complemented by continuous evaluation of identity, relationship, authority and credential status signals, as well as runtime authorization based on context and intent. EUDI Wallets could become one additional driver of that transition.

The core responsibility of IGA remains unchanged. Traditional RBAC and policy-based governance still determine how verified identity, partner relationships and mandates translate into entitlements — and which access must be removed when the underlying trust changes. That remains identity governance's bread and butter.

The proliferation of AI agents is driving a major shift in the traditional identity model. The world is moving beyond static access and roles towards a more dynamic, agentic control plane built on continuous governance, controlled access to tools and resources, and runtime authorization that evaluates context and intent before an action is executed.