ID Partners · for PingAuthorize
As more applications and AI agents use your systems, each needs clear limits. Can this agent make a payment? Can this application see a customer's account? Our extensions let them ask your existing PingAuthorize rules before they act. Our reference design shows how to keep a task within the purpose the customer approved.
Authorisation is the decision about what a person or application is allowed to do.
The problems we address
Connecting each application to your access rules takes work. AuthZEN is an open standard for asking whether an action is allowed. The adapter lets applications that support AuthZEN ask PingAuthorize in the same way.
Your team connects the standard request to your existing rules. PingAuthorize continues to make the decision.
See how access checks workAny application holding the same key can use it. Workload identity gives each running application a verifiable identity. PingAuthorize can then apply different rules to a payments application and a reporting job.
The extension uses short-lived certificates that renew without restarting the server.
See how applications identify themselvesA customer asks an agent to pay a bill. That agent passes work to another agent. The next agent tries to use the payment history for marketing.
Purpose-bound delegation checks each participant against the original task. This reference design shows how PingAuthorize can refuse that extra use.
See how delegated tasks are checkedThe extensions install into PingAuthorize. Your team gets configuration files for repeatable setup and builds matched to PingAuthorize 10.0 to 10.2, 10.3 and 11.
The delegation reference design also needs a service that checks participants' purposes.
See what your team needsIn practice
A website and an AI agent can ask the same access rules whether a customer may make a transfer. Your team manages those rules in PingAuthorize.
A high-value transfer can be refused until the customer completes a stronger sign-in. The response tells the application what is required.
An application can ask which accounts a customer is allowed to act on. The result comes from your access rules.
The Shared Signals Framework is an open standard for sharing security events. The adapter can send signed access decisions to the systems that subscribe, such as a security monitoring tool. When PingAuthorize runs across several servers, they can share one set of subscriptions and send each decision once.
What is available
The AuthZEN Adapter and workload identity extension run inside PingAuthorize. Connecting existing policies to AuthZEN requires an initial configuration step.
Purpose-bound delegation is a working example your team can evaluate. It uses the adapter alongside additional policies and services.
Testing
The adapter passed 147 of 147 tests across six OpenID Foundation AuthZEN test plans on 7 October 2026, running on PingAuthorize 11.1. Conformance testing checks whether an implementation behaves as the standard requires.
This result is evidence of conformance. The AuthZEN test plans are still at an early stage and are not yet part of the OpenID Certification programme. ID Partners can confirm compatibility with your exact PingAuthorize release.
See how the adapter is tested
