Field-proven authorization patterns

Seven patterns proven in a full-scale platform build now inform the B5SecurityKit roadmap: a grant catalog with human-only and step-up bits and role bundles as first-class kit types; a decision-ledger UI component that shows every allow and deny with its policy id and reason; a passkey ceremony validator covering challenge, origin, relying party, presence, and counter regression; a session doctrine where suspension kills sessions immediately; an agent authority model where AI agents act only for a principal with narrowed grants, never with credentials of their own; a versioned security-events export schema as the SIEM contract; and a startup completeness gate that names any operation lacking an authorization binding at startup, so nothing ships unauthorized by omission.

Each pattern ships with tests and documentation as it lands in the kit. The 4.0.3 track — passkeys, AI-agent authorization, the security events export, and the validated integration runbook — remains the near-term release train.