One Form, Three Frameworks

Pulse IQ, Framework Evaluator Dashboard

Build a Vendor-Neutral AI Prompt to Evaluate or Compare Any Identity Provider

Affirmed Identity — July 2026

Upfront Caveats

Where ZTA and CMMC are concerned, the focus of this tool is on Identity and Access, a core pillar of ZTA and the common foundation that connects ZTA to CMMC. Otherwise, the evaluations are fair and balanced within that space.

The Eleven Rules, by contrast, are foundational attributes, common-sense contributors to securing both agentic AI sessions specifically and authenticated sessions generally. They are the principles on which the Pulse CA architecture itself was founded and against which it was designed to measure up. The rules as documented here carry no certification or endorsement but, they are individually accredited by various industry and government standards, acknowledged here by reference with links to the sources. And, as such, they serve as a fair basis for evaluating the fitness of security frameworks, products, or services, Pulse CA and Reflex included.

Differences are Expected when using different underlying AI models (e.g., Claude vs. ChatGPT). They may include: differences in scoring, emphasis, or narrative from the same prompt applied to each. This is normal and should not be seen as inconsistency in the tool methods or the rules it applies. The golden rule of AI agents, no two models are alike, and no two generations of the same model are alike.

Quick start to evaluate IdP or IAM fitness for securing authenticated sessions in general and agentic AI sessions specifically:

Scroll to and complete “Reference A”, product name as advertised is required, domain is optional but suggested;
continue down to and tap “Copy Prompt & Rules”;
in your AI Assistant, select New Chat;
page refresh (upper left corner of browser); and
paste clipboard to chat window and tap Send.

Step 1 — Output Detail

How much do you want back from the AI for each item scored?

Brief — a single score per item: Achieved, Partial, or Unachieved. No narrative.

Table Output — Two Columns — ask the AI to return Brief results as a table with columns for Rule/Article and Score. Unchecked by default. Table Output — Three Columns — ask the AI to return Brief results as a table with columns for Framework, Rule/Article, and Score. Unchecked by default.

Full Analysis — a score per item, the reasoning behind it, and, where it's Partial or Unachieved, a specific suggestion for closing the gap. Scores Only — no per-item detail. Just a single percentage score for each Point of Reference selected in Step 3, plus a grand total across all of them combined. Achieved = 1, Partial = 0.5, Unachieved = 0.

Step 2 — What to Evaluate

Product name as advertised by its publisher is needed. Domain is optional but for best results should be the publisher’s website.

Reference A

Reference B (optional — adds a comparison or combined evaluation)

With both filled in, how should they be evaluated?

Compare head-to-head — score Reference A and Reference B independently against each article and compare the results. Evaluate combined, as one solution — treat Reference B as deployed alongside or on top of Reference A, and score what the two achieve together, article by article, not either one alone. Useful for testing whether adding a product like Pulse CA closes the gaps an existing IdP leaves open.

Step 3 — Points of Reference

Select one or more published frameworks to score against. Each selection adds its full reference text to the copied output.

The Eleven Rules of Secure Agentic AI — session security for human and agentic AI sessions alike. Articles of Zero Trust — identity conformance to NIST SP 800-207. Articles of CMMC Compliance — identity and audit practices for CMMC Level 2 and Level 3.

Identity Only — limits the Zero Trust and CMMC reference rules to those most directly tied to identity and access: CMMC Rules One, Two, Three, Six, Ten, and Eleven; ZTA Rules Two, Three, Four, Five, Six, and Eight. The Eleven Rules are unaffected. Checked by default.

How to Use What You Build Above

With the dashboard set, scroll down and select either Copy Prompt & Rules or Copy Reference Rules Only.
Start a brand-new AI agent session — not a continuation of a previous evaluation.
Paste the prompt and rules into the agent session's input field.
Send or launch the prompt.

Getting different or degraded results running the same settings twice? This almost always means the second run was pasted into the same conversation as the first, rather than a fresh one. Each run adds its full reference text and the model's prior answer to that conversation's context, so a second run in the same chat is evaluating against a longer, noisier context than the first, not the same question. The prompt this tool generates is identical every time for identical settings; consistency depends on giving each run its own new session.

Note: selecting all three Points of Reference with Full Analysis may overload some conversational AIs. If that happens, break the task into three separate sessions, one per Point of Reference. Doing so while comparing two products naturally doubles the load, so that's the combination most likely to need splitting up.

Your Generated Prompt

"Copy Prompt + Reference Rules" is the one you want in almost every case, it's a single paste into your AI agent. "Copy Reference Rules Only" is there if you'd rather write your own question around the same reference text.

References

Standards, specifications, and authorities from which the Eleven Rules are derived or with which they align. Draft and evolving specifications are identified as such.

Coalition for Secure AI (CoSAI), Workstream 4. Agentic Identity and Access Management. OASIS Open Project, 2026. https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/tree/main/whitepapers/agentic-identity-and-access-control.pdf
NIST SP 800-63-4, SP 800-63B-4, and SP 800-63C-4. Digital Identity Guidelines; Authentication and Authenticator Management; Federation and Assertions. 2025. https://csrc.nist.gov/pubs/sp/800/63/b/4/final
NIST SP 800-207. Zero Trust Architecture. 2020. https://csrc.nist.gov/pubs/sp/800/207/final
NIST SP 800-53 Rev. 5. Security and Privacy Controls for Information Systems and Organizations (AC, AU, IA, IR families). https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
NIST NCCoE. Accelerating the Adoption of Software and AI Agent Identity and Authorization (draft concept paper). February 2026. https://www.nccoe.nist.gov/projects/software-and-ai-agent-identity-and-authorization
CISA. Implementing Phishing-Resistant MFA (fact sheet).
W3C. Web Authentication (WebAuthn). FIDO Alliance. Client to Authenticator Protocol (CTAP2). https://www.w3.org/TR/webauthn/
IETF RFC 6749. The OAuth 2.0 Authorization Framework. https://www.rfc-editor.org/rfc/rfc6749
IETF RFC 8693. OAuth 2.0 Token Exchange. https://www.rfc-editor.org/rfc/rfc8693
IETF RFC 8705. OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens. https://www.rfc-editor.org/rfc/rfc8705
IETF RFC 8707. Resource Indicators for OAuth 2.0. https://www.rfc-editor.org/rfc/rfc8707
IETF RFC 9449. OAuth 2.0 Demonstrating Proof of Possession (DPoP). https://www.rfc-editor.org/rfc/rfc9449
OpenID Foundation. Shared Signals Framework (SSF) and Continuous Access Evaluation Profile (CAEP). https://openid.net/wg/sharedsignals/
OWASP. Top 10 for LLM Applications. https://genai.owasp.org/llm-top-10/
Model Context Protocol. Authorization specification. https://modelcontextprotocol.io/specification/
ISO/IEC 27002:2022. Information security controls.
MITRE ATT&CK and MITRE D3FEND. https://attack.mitre.org/

← Back to Top