The standards
Open standards already define who may act for whom. HBX carries them all the way to the systems that run production.
OpenID Connect, ID-JAG, Cross-App Access, DPoP, and CIBA are not features we bolted on. HBX is built on them, so your identity provider stays the source of who is who.
The five standards
Each one answers a question your security team will ask.
Nobody buys a standard. What you're buying is the answer each one gives to a question that comes up the first time an agent touches something that matters.
Who the human is
OpenID Connect
Lets one system accept an identity another system vouched for, with no shared password. It is why your company can have one login, and why every step in the chain traces back to a person you already know.
Who the agent is acting for
ID-JAG
A signed statement that says this agent acts for this named person, for this purpose, until this moment. Your identity provider makes the decision and HBX authorizes against it, so the audit line names a person, not a shared login.
How the assertion travels
Cross-App Access
The way to hand that permission to the system that has to honor it, even when the two belong to different companies. An agent authorized by a contractor's identity provider arrives at your system still attributable to their engineer.
Why a stolen token is useless
DPoP
Ties the access pass to a key only the caller holds, so a copy of the pass is useless without the key. In agent work, where these passes show up in logs, prompts, and memory, that is the difference between a leak and an incident.
How a person says yes, out of band
CIBA
Lets the system pause and ask a real person to approve on their own device before the action proceeds, and get back a signed answer rather than a checkbox. It puts a person in front of the destructive command without putting them in front of a terminal.
The chain, end to end
Five standards doing one job: keeping a name attached to an action.
A person authorizes an agent. The agent asks for a specific job. A human approves the destructive part. A temporary login is created on the target that only works for that job, and is removed when it ends.
Interoperability
Interop tests run and filed in the OpenID Foundation's program.
The interop event
HBX has run and filed interoperability tests in the OpenID Foundation's AIIM interop event. The Foundation publishes the results and names the participants, so we name nobody ahead of it.
What standing on standards buys
Named standards can be checked, not taken on faith.
When delegation is a proprietary fabric, the fabric becomes the authority on which agents exist and what they may do, and your identity provider is reduced to a source of records feeding it. When delegation is an open standard, it keeps working when it comes from a partner's identity provider instead of your own.