Catch the missing guard at build time.
The most common authorization defect is not a wrong rule. It is a method with no check on it at all — and nothing about that method looks broken. Analyzers move that class of defect from production to the compiler.
1. What this enforces
At build time: methods that expose protected operations without an authorization check, permission identifiers that do not exist, and explicit bypasses that are not accompanied by a documented justification.
2. Where it enforces
In the compiler and in CI, before the code can ship. An analyzer is the only check that runs on a code path no test exercised.
3. What evidence it produces
A build result, and a record of the bypasses that were accepted and by whom. An unexplained bypass that compiles is a policy decision made silently.
4. Why you cannot assemble this from what you already own
A reviewer reading a diff cannot see the absence of something. A test suite covers the paths it was written for. A gateway cannot know that an internal method was left unprotected, because it never sees the internal call.
5. What Q4 2026 adds
Roslyn Analyzers and Build Gates
Detect missing or conflicting protection, unsafe bypasses, unresolved entities, broad permits and unprotected sensitive methods.
6. Acceptance criteria
These are the conditions the capability must satisfy to be considered complete. They are quoted from the specification rather than paraphrased, because an acceptance criterion that has been reworded is no longer the criterion.
- Analyzer identifies every intentionally unprotected sensitive method in the test corpus. MF-009
- High-severity analyzer findings can fail CI. MF-009
- Suppression requires justification and creates evidence. MF-009
7. What is still open
The following are genuinely undecided rather than merely undocumented, and each one changes what the capability is:
- Whether missing protection is an error or a warning by default. Error is correct and adoption-hostile; the migration path decides this.
- How the analyzer learns which operations are protected — attribute-driven, convention, or an explicit manifest.
- Whether the bypass justification lives in the code or in the control plane.
Every Q4 2026 extension is also held to four platform-wide requirements, six test classes and four release gates. They are published once, on the Q4 2026 roadmap, rather than repeated on every page.
Talk to a human.
Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.