Citadel

The problem

An admin is asked to approve an application that wants Mail.Read. Is that risky?

Today the honest answer is “it depends, and the tool that told you High cannot show you why.” Permission risk ratings are usually static, vendor-specific, and opaque. Worse, they judge the permission in isolation — a well-governed internal app with two named owners and a managed identity gets the same rating as an unverified multi-tenant app with a wildcard redirect URI and no owner at all.

Those two requests are not the same risk. Every admin knows it. No standard says it.

OARS — Open App Risk Standard

A dual-layer model that scores the application’s own trust posture alongside the impact of the permissions it requests, and combines the two into a consent decision. Currently Draft.

Read the standard →

Machine-readable

Every release publishes versioned JSON — the model and the ratings dataset — so tools implement the same scoring and reach the same answers.

Browse the dataset →

Openly governed

A rotating chair, decisions made in public and recorded on GitHub, and no single owner. Founding authors are credited permanently.

How it works →

Built on real work

OARS is derived from the Graph Consent Risk Framework by Khurram Chaudhary, whose dual-layer model is the substance of this standard.

Contribute →

Status

This standard is a draft published for open review. It is not ratified and will change. There are open questions the working group has still to resolve — including one that affects every score in the dataset.

If you run Entra tenants and think a rating is wrong, that is exactly the feedback this draft exists to collect.