Ten thousand decisions without ten thousand calls.
Listing, exporting and reconciling all ask the same question thousands of times with a different subject each time. Doing that one decision per round trip is how authorization becomes the reason a report takes four minutes.
1. What this enforces
The same decision, at the same fidelity, for many resource and action pairs in one evaluation — with the same reason codes and the same evidence per subject as a single decision would produce.
2. Where it enforces
In-process, in the same evaluation context, so an aggregate consulted once is consistent across every subject in the batch. A batch evaluated against shifting state is not a batch, it is a race.
3. What evidence it produces
Per-subject outcomes and reason codes, not a single aggregate verdict. ‘Partially permitted’ is not an auditable answer.
4. Why you cannot assemble this from what you already own
A per-item call to an external policy engine multiplies network latency by cardinality. Doing the filtering in SQL moves the authority into a query that no policy reviewer will ever read. Neither produces per-subject evidence.
5. What Q4 2026 adds
Batch Authorization
Evaluate many actions and resources in one deterministic request with per-item decisions, reasons, limits and backpressure.
6. Acceptance criteria
These are the conditions the capability must satisfy to be considered complete. They are quoted from the specification rather than paraphrased, because an acceptance criterion that has been reworded is no longer the criterion.
- A batch returns a decision and reason for each requested tuple. MF-004
- Partial failure behavior is explicit and deterministic. MF-004
- Reference benchmark demonstrates bounded memory and latency at the documented maximum batch size. MF-004
7. What is still open
The following are genuinely undecided rather than merely undocumented, and each one changes what the capability is:
- The ordering and atomicity guarantees: whether a batch sees one consistent snapshot, and what happens if state changes mid-batch.
- Result shape for large batches — inline, streamed, or a retrievable result set.
- How aggregate limits are consumed by a batch that is partially permitted.
Every Q4 2026 extension is also held to four platform-wide requirements, six test classes and four release gates. They are published once, on the Q4 2026 roadmap, rather than repeated on every page.
Talk to a human.
Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.