No new policy language to learn. No external decision to call. Just [Permission], in .NET.
Oso brought authorization-as-its-own-discipline to developers, with the Polar policy language and Oso Cloud. The instinct — treat authorization as a first-class concern, decoupled from scattered checks — is one B5 shares. But Oso asks you to learn Polar and, in Oso Cloud, to externalize the decision. B5 delivers the same first-class authorization as idiomatic C# attributes, enforced in-process at the call site.
Framing: Treat authorization as first-class — via native .NET attributes, enforced in-process, with no new language.Oso made the case that authorization deserves to be its own thing.
Oso’s contribution is conceptual and real: authorization should be a deliberate, first-class layer, not hand-written checks sprinkled through controllers — and Oso’s own competitive analysis sharply diagnoses the field’s friction (steep policy languages, external data stores). B5 agrees with the diagnosis and answers it differently. Where Oso introduces Polar as a new language and Oso Cloud as an external decision service, B5 expresses authorization in idiomatic C# and enforces it in-process — first-class, but native.
Borrow this, don’t fight it
- Reframed authorization as a first-class, deliberate layer
- Polar — an expressive, purpose-built policy language
- Oso Cloud for centralized, managed authorization decisions
- An unusually candid competitive analysis of the FGA landscape
First-class authorization, but a new language and (in Cloud) an external hop
- Polar is another language for the team to learn and maintain alongside C#
- Oso Cloud externalizes the decision — a service call and dependency on the hot path
- Centralized decision services add a round trip and a sub-processor question
- B5 expresses policy in native .NET attributes and enforces in-process — no new language, no hop
Oso decides. B5 enforces — at the line of code.
| Oso | B5 Secure | |
|---|---|---|
| Locus of enforcement | Embedded library or Oso Cloud (external service) | In-process, at the call site |
| New live attack surface | Yes (Oso Cloud) / varies | No added service or endpoint |
| Authorization data leaves your boundary | Oso Cloud: data leaves; embedded: stays | No — evaluated in-process |
| New sub-processor for the customer | Often (Oso Cloud) | No |
| .NET integration | Generic SDK + Polar language | Idiomatic [Permission] attributes & middleware |
| Agent identity model | Resource-scoped | First-class + in-process enforcement today; agent OBO + ephemeral scope is a Q4 2026 roadmap extension |
| Best role in your architecture | Model decisions (its own layer) | Enforce the decision where it executes |
Capability status. In-process [Permission] enforcement Generally Available Agent OBO delegation, ephemeral SPIFFE-compatible agent identity and CAEP/SSF signal ingestion are Q4 2026 roadmap extensions Preview.
The questions a buyer actually asks
We like that Oso makes authorization first-class.
So does B5 — that’s common ground. The difference is how: Oso asks you to adopt Polar and, for centralized decisions, Oso Cloud. B5 makes the .NET method the first-class authorization point via a [Permission] attribute, evaluated in-process. Same principle, native delivery, no new language.
Oso has an embedded library too — isn’t that in-process?
The embedded path keeps you in Polar and in Oso’s model; centralized features push you to Oso Cloud. B5 keeps the whole decision in idiomatic .NET at the call site, with agent OBO scope and CAEP/SSF signals planned as first-class inputs — built for the regulated Microsoft/Azure stack.
What about agents?
B5 treats humans, services, and agents as one model: ephemeral, SPIFFE-compatible agent identities with OBO-delegated scope enforced at the method (H2 2026 roadmap) (H2 2026 roadmap). That agent-first, in-code enforcement is the sharpest line between B5 and a general-purpose authorization engine.
Complementary, not competitive.
Authorization as a first-class layer — native to .NET.
If your team values authorization as its own discipline, B5 honors that instinct without a new language or an external decision service: the policy is the [Permission] attribute on the method, evaluated in-process every call, inside your boundary. First-class authorization, expressed in the language your application already speaks.
First-class authorization, in idiomatic .NET — no Polar, no external hop.
Bring your architecture to a B5 architect. We’ll show you exactly where Oso ends and where in-process enforcement begins — and the Trust Center a library, not a platform, gets to publish.
See enforcement at the record. Live.
Thirty minutes with a B5 engineer: your stack, the B1–B5 pipeline, and a data-element authorization decision you can watch happen — for humans, services, and AI agents alike.