It's standards based just like any other SSO these days: OpenID Connect and SAML. Is there something specific you want to know?
The "FedRamp" contract overhaul pretty much locks in the requirements and specifications to these above implementations.
I have designed an API that revolves around and side-steps this that currently serves 60 million US civilians...but in the end, the security assessment pretty much comes down to the Privacy Acts interpretations and the common sense security landscape.
If you are a leader in the bureaucracy, your incentive is to not personally fail, which is not the same as to succeed.
There is an army of auditors waiting to question every decision, so the obvious way to avoid that is to not make any. Balancing the need to do something without deciding anything is an art of sorts.
That creates an incentive never to label anything a failure and just keep pumping good money after bad - that's how to avoid the negative article.