Enforcement belongs on every entry point.
Authorization applied only to HTTP controllers protects the front door of a building with many doors. Queue consumers, timers, gRPC services and actor messages all execute business operations, and each is an entry point.
This capability is available in Preview today. The Q4 2026 roadmap extension adds the capabilities described below; production availability has not yet been declared. Both badges above are rendered from the Product Truth Registry.
1. What this enforces
The same in-process decision at every host, with the same reason codes and the same evidence, so a capability present on one host and absent on another is a defect rather than a roadmap item.
2. Where it enforces
At the business method, which is what makes host parity achievable: the decision does not live in host-specific middleware.
3. What evidence it produces
Identical evidence across hosts for an equivalent operation. Byte-identical evidence for the same decision on two different hosts is the strongest conformance test available, and it is the one to hold this to.
4. Why you cannot assemble this from what you already own
Middleware protects a pipeline. A message arriving on a queue never traverses that pipeline, and neither does a timer firing. Every framework-level authorization story has the same hole, and it is the hole through which background processing reaches the database.
5. What Q4 2026 adds
Expanded Runtime and Framework Coverage
gRPC, SignalR, Functions, workers, messaging, Dapr, Orleans, Blazor and scheduled jobs.
6. Acceptance criteria
The specification defines this capability against the three baseline criteria that apply to every Q4 2026 extension — documentation with failure modes and a runbook, automated coverage of primary and abuse cases, and telemetry that emits evidence without exposing prohibited data. Capability-specific criteria have not been written yet, and this page will state them when they are rather than inventing them now.
- The capability is documented with configuration, failure modes, security implications and an operational runbook.
- Automated unit, integration, negative and regression tests cover the primary and abuse cases.
- Telemetry and audit evidence are emitted without exposing prohibited sensitive data.
7. What is still open
The following are genuinely undecided rather than merely undocumented, and each one changes what the capability is:
- The specification’s own runtime list omits ServiceStack, while the platform specification makes ServiceStack a first-class host with its own conformance suite and forbids describing it as transitional. The list needs correcting; this page states the position the platform specification takes.
- Which hosts are in the first conformance wave, and what the pass criteria are.
- How ambient context is established on hosts that have no request — a queue consumer has a message, not a caller.
Every Q4 2026 extension is also held to four platform-wide requirements, six test classes and four release gates. They are published once, on the Q4 2026 roadmap, rather than repeated on every page.
Talk to a human.
Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.