1. Why a unified identity model

Systems fail at the seam between “users” and “services.” When human and machine identities run through different code, one of them is inevitably weaker — usually the service path, built for convenience and trusted because it is “internal.” Treating every actor as a first-class identity in one model removes that seam and the asymmetry that hides in it.

2. Many kinds, one pipeline

Site-to-site keys, feature keys, and user sessions differ in how they prove themselves but not in how they are judged: each is authenticated, then authorized against the action and the record, then checked for posture and suspension. A policy improvement applies to all of them at once, and there is no “service” back door running a shorter gauntlet.

3. How B5 Secure handles it

In B5 Secure, identities are first-class regardless of type, all flowing through the same authentication and authorization stages. This is what makes “verify every request” tractable across a heterogeneous client base — one model to reason about, one bar to clear.