Authorize the action and the data.
Authorize not just the action but the specific data it touches, down to individual records and fields. Conventions derive permission codes and flag sensitive fields automatically, so authorization stays consistent without hand-written checks in every handler.
1. The gap endpoint checks leave open
Most authorization stops at the endpoint: may this caller invoke “read account”? That is necessary and insufficient. The breach lives one level down — the caller who may read accounts in general but reads this account, which is not theirs. Object-level (record) authorization is consistently among the most exploited weaknesses in real systems precisely because endpoint checks pass while record ownership goes unverified.
2. Activity-data authorization
Activity-data authorization (ADA) closes that gap by resolving permissions against the specific data in play: the action, the record, and where needed the individual fields. A partner scoped to its own customers cannot widen a query to everyone else’s; a role that may see a name cannot see the tax identifier on the same record. Authorization becomes a property of the data, not just the route.
// Endpoint-level: necessary, not sufficient
[Permission("account.read")] Account Get(string id) {...}
// ADA: resolve the permit against the record + caller, fail closed
ada.Authorize(caller, "account.read", id); // this account?
var view = ada.Project(caller, account); // which fields?3. Consistency through conventions
Per-record, per-data-element checks are powerful and, written by hand in every handler, error-prone — the one place someone forgets is the vulnerability. B5 Secure derives permission codes and flags sensitive fields by convention, so the authorization surface is generated and uniform rather than reconstructed endpoint by endpoint. Consistency, here, is the security property.
4. How B5 Secure handles it
ADA is the authorization heart of the B5 Secure pipeline. It enforces least privilege at the record and field level and shapes what is returned to the caller — the same mechanism behind “grant least-privilege access” and “limit the data you return.” Because it is convention-driven, the protection scales with the application instead of decaying as handlers multiply.