What B5 does when the truth is late.
Every distributed authorization system reads state that may be out of date. The question is not whether staleness happens but what the system does about it, and whether that behaviour is something you chose.
1. What this enforces
A declared maximum staleness per decision class. When the state B5 needs is older than the policy allows, the decision fails rather than proceeding on stale authority — the same fail-closed principle that governs revocation.
2. Where it enforces
In-process, at the point the decision is made, because that is the only place that knows how old the state it just read actually is.
3. What evidence it produces
The age of the state consulted, recorded on the decision itself. A permit issued against three-second-old state and a permit issued against three-hour-old state are not the same permit, and the evidence should say so.
4. Why you cannot assemble this from what you already own
A cache in front of a policy engine hides staleness rather than declaring it. A gateway cannot know how stale the data-element-level authorization state behind it is. Reasoning about split-brain requires knowing which side of the partition the enforcement point was on, which is an in-process fact.
5. What Q4 2026 adds
Distributed Consistency and Offline Controls
Explicit consistency modes, cache freshness, policy refresh, split-brain behavior, offline operation and recovery controls.
6. Acceptance criteria
The specification defines this capability against the three baseline criteria that apply to every Q4 2026 extension — documentation with failure modes and a runbook, automated coverage of primary and abuse cases, and telemetry that emits evidence without exposing prohibited data. Capability-specific criteria have not been written yet, and this page will state them when they are rather than inventing them now.
- The capability is documented with configuration, failure modes, security implications and an operational runbook.
- Automated unit, integration, negative and regression tests cover the primary and abuse cases.
- Telemetry and audit evidence are emitted without exposing prohibited sensitive data.
7. What is still open
The following are genuinely undecided rather than merely undocumented, and each one changes what the capability is:
- The default staleness bound, and whether it is expressed in time, in version distance, or both.
- Offline behaviour: whether a disconnected node denies everything, denies writes only, or serves a signed short-lived permit set.
- Whether split-brain recovery reconciles decisions or simply records that a partition occurred.
Every Q4 2026 extension is also held to four platform-wide requirements, six test classes and four release gates. They are published once, on the Q4 2026 roadmap, rather than repeated on every page.