Patterns

Use Cases

Use cases should map to enforceable identities, policies, credentials, entitlements, and evidence. They are not marketing labels floating above the architecture.

Core patterns

Protected enterprise APIRequest signing, replay defense, authorization, and evidence for internal or customer APIs.Open →Mobile applicationDevice-aware access without embedding a tenant signing secret.Open →Android applicationHardware-backed keys and integrity signals.Open →Managed browser extensionEnterprise browser workflows with bounded session authority.Open →Hybrid/on-premises serviceOutbound-only connectivity for private APIs and data.Open →Partner/channel integrationDelegated access with authoritative licensing and entitlement under B5.Open →

Regulated and AI workloads

Financial operationsTenant-isolated transaction and account workflows with decision evidence.Open →AI agentsDistinct workload and agent identities, bounded tools, delegation, and audit.Open →Licensing and entitlementAuthoritative grants across direct, partner, marketplace, MSP, distributor, and public-sector channels.Open →Incident containmentCredential revocation, session termination, replay defense, and evidence preservation.Open →

Implementation steps

Select a use case and identify the human, application, workload, agent, device, and partner identities involved.

Define the minimum scopes and entitlements required.

Choose the corresponding integration guide.

Test denial, revocation, replay, outage, and recovery behavior before production.

Control details

Financial

Use B5 to bind tenant, application, actor, subject, action, resource, decision, and evidence identifiers across regulated operations.

Agents

Treat each AI agent and delegated tool invocation as a distinct identity and authorization event with bounded authority and evidence.

Licensing

The sales channel may vary, but license issuance, entitlement truth, audit, customer identity, renewal, and revocation remain authoritative under B5.

Incident

Containment requires rapid key and token revocation, session invalidation, replay-store continuity, evidence export, and recovery controls.

Choose a working pattern

Use case to implementation guide

APIProtected .NET APIHMAC signing, replay defense, policy, and evidence.Open guide →iOSApple native appPKCE, secure storage, device proof, and App Attest.Open guide →AndroidGoogle Android appPKCE, Keystore, device proof, and Play Integrity.Open guide →MV3Chrome extensionSession authority, WebCrypto, and managed deployment.Open guide →HybridOn-premises APIOutbound connector and protected execution context.Open guide →PartnerPartner APIDelegated authority with B5-controlled entitlement and audit.Open guide →

Developer Relations

Talk to a human.

Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.

Contact Developer Relations Request a demo