Session-based trust was built for humans who log in once. Agents broke it.

The identity model the enterprise runs on assumes a principal authenticates at the front door, receives a session, and is trusted for its duration. That assumption survived two decades because humans are slow, singular, and supervised. An AI agent is none of those things. It is provisioned in milliseconds, fans out into a tree of sub-agents and tool calls, and reaches the method that authorizes a wire transfer thousands of times an hour — long after any login decision was made. The question is no longer “who logged in?” It is “is this action, by this agent, on behalf of this human, allowed — right now, at the call site?”

B5’s contribution is where the fabric is enforced: in-process, in .NET, at the line of code. The platforms decide. B5 enforces — at the point the agent actually invokes the tool.

Humans, services, and AI agents — one model, enforced in your application tier.

A unified identity model requires treating an AI agent as an autonomous, first-class principal whose ephemeral actions are continuously traced back to provable human authority and executed with scope-limited, time-bound credentials. Four components, each mapped to where B5 enforces it.

Not every agent should carry the same ceiling.

B5 models three delegated-authority classifications as distinct principal types feeding the same attribute-based policy evaluation. The class sets the ceiling; the call site enforces it.

The delegated scope reaches the method — or the method refuses to run.

Control planes decide at the edge; the action still executes deep inside your code. B5 binds the authorization decision to the method that does the work via a declarative attribute. Today, that decision is a per-action [Permission]/ADA check evaluated at the call site — no gateway-said-yes-but-the-code-forgot-to-check gap, and no network hop on the hot path. On the H2 2026 agent layer, an agent’s On-Behalf-Of token narrows that same check to the delegated scope.

// TODAY — per-action [Permission] + data-element ADA, enforced in-process
// at the exact call site, for every principal including AI agents.

[Permission("payments.initiate")]
public async Task<PaymentResult> InitiatePaymentAsync(PaymentRequest req)
{
    // Reached only if the caller carries payments.initiate AND the
    // ADA data-element check passes for req.AccountId.
    return await _ledger.PostAsync(req);
}

// H2 2026 — Agent extension: OBO-delegated ceiling (RFC 8693)
// + live CAEP/SSF risk, layered on the same in-process enforcement point.

[Permission("payments.initiate", MaxAmount = "delegated")]   // delegated ceiling — H2 2026
public async Task<PaymentResult> InitiatePaymentAsync(PaymentRequest req)
{
    // Reached only if the OBO scope covers payments.initiate AND
    // req.Amount <= the delegated ceiling AND live risk signals permit.
    return await _ledger.PostAsync(req);
}

Continuous authority is only as strong as its last enforcement point. B5 is that point — the Policy Enforcement Point that compiles into your application.

Every tool is an identity. Every invocation earns its access.

As agents reach the world through the Model Context Protocol and through tool-calling frameworks, the unit of authorization becomes the tool invocation itself — the natural unit in .NET, where each tool maps to a discrete method with a discrete permission.

Complementary, not competitive. The platforms decide. B5 enforces.

Use a control plane to decide and detect across your estate. Use an external authorization engine to model decisions. Use B5 to enforce the decision where it executes — in your .NET tier, inside your boundary.

Agentic use cases, at financial-grade scope.

B5 is the enforcement substrate — the best-in-class PEP, not the whole fabric.