Key Concepts

These are the terms and constructs you’ll meet throughout B5 Secure. Skim them once; refer back as needed.

Permissions, permits & permit groups

A permission is the right to perform a single action (a web operation), identified by a unique code such as contact.update. A permit is a grant of one or more permissions to an identity — optionally scoped to a specific entity record. Permit groups bundle permissions into reusable roles you assign to identities.

Identity & identity tokens

An identity is the authenticated subject of a request — a user, an API key, or a service. An identity token is the credential presented on each request that B5 Secure validates to establish that identity (a session cookie, an HMAC token, a service key, and so on).

API keys

B5 Secure distinguishes several key kinds, each with different trust and scope:

• Public key — embedded in untrusted clients (e.g. a sign-up widget). Restricted by origin/domain allow-list and granted only minimal permits.
• Site-to-site key — a sensitive server-to-server credential, typically locked to an IP allow-list via the firewall.
• Service key — a scoped key granting an integration only the precise endpoints it needs.

User sessions

A user session represents an authenticated interactive user. Crucially, B5 Secure applies the same checks — including the IP firewall — to user sessions and API keys, so you can restrict even high-privilege user accounts to known networks.

The security context

The security context is the per-request object that holds the resolved identity, its permits, and the request’s security state. Your application reads from it to make fine-grained decisions; the pipeline writes to it as each stage runs.