Standards registry

Every standard Open Citadel maintains or plans, with its current status and who edits it. Machine-readable equivalent: standards.yaml.

Lifecycle stages are defined in GOVERNANCE.md:

Draft  ──▶  Public Review  ──▶  Ratified vX.Y  ──▶  Superseded

---

OARS — Open App Risk Standard

Status: Draft · Version: 0.1.0-draft · Repository: opencitadel/OARS

Rates the risk of applications and the permissions they request in Microsoft Entra ID. A dual-layer model: the application’s own trust posture is scored alongside the impact of the permissions it requests, and the two tiers combine on a highest-risk-wins basis to route the consent decision.

Founding author	Khurram Chaudhary (@kuddyc)
Founding spec editor	Khurram Chaudhary (@kuddyc)
Derived from	Graph Consent Risk Framework, 2026
Licence	CC BY 4.0 (specification and dataset), MIT (code)
Outputs	oars-model.json, oars-permissions.json, oars-combos.json

Before Public Review: five open questions must be resolved, one of them blocking — the specification describes two aggregation methods that disagree by a full tier. See open questions.

---

Entra role tiering

Status: Planned · no working group yet

Classifying Entra directory roles as Critical, High, Medium, or Low, using the same principle as OARS: publish the factors and the reasoning, not just the label.

A working group forms when there is a standard to write and at least two people committed to writing it. If that is you, open a discussion proposing the scope, the initial editors, and the intended deliverable — the process is in GOVERNANCE.md.

---

Proposing a new standard

Open Citadel standards address questions where a Microsoft security decision is made repeatedly, by many people, using reasoning nobody can inspect.

A good candidate has all of these properties:

• The question is asked routinely by administrators or security teams
• The answer today is opaque, vendor-specific, or purely tribal
• The inputs are programmatically retrievable rather than self-attested
• The output is useful to tools, not only to humans

If your idea fits, propose it in Discussions.

---

Source: community/STANDARDS.md