Governance proves the guard exists. B5 is the guard.
Azure Policy and AKS admission control answer a different question from the one B5 answers. They govern whether a workload is configured and deployed as the organisation requires. B5 governs what that workload may do once it is running.
1. What this enforces
Nothing at runtime. The governance surface asserts that enforcement is present and correctly configured — that the guard has not been removed, disabled or downgraded — and reports where it has drifted.
2. Where it enforces
At deployment and continuously thereafter, outside the request path.
3. What evidence it produces
An inventory of where B5 enforcement is deployed, at what policy version, and where the observed state differs from the declared state.
4. Why you cannot assemble this from what you already own
A deployment gate cannot make a per-action decision, and an in-process decision cannot tell you that someone shipped a service with enforcement switched off. The two are complements, and conflating them is how an estate ends up with excellent governance over services that authorise nothing.
5. What Q4 2026 adds
Azure Policy and Deployment Governance
Inventory and compliance controls to identify production .NET workloads missing or misconfiguring B5.
6. Acceptance criteria
The specification defines this capability against the three baseline criteria that apply to every Q4 2026 extension — documentation with failure modes and a runbook, automated coverage of primary and abuse cases, and telemetry that emits evidence without exposing prohibited data. Capability-specific criteria have not been written yet, and this page will state them when they are rather than inventing them now.
- The capability is documented with configuration, failure modes, security implications and an operational runbook.
- Automated unit, integration, negative and regression tests cover the primary and abuse cases.
- Telemetry and audit evidence are emitted without exposing prohibited sensitive data.
7. Dependencies
Beyond the platform baseline every extension depends on — the B5 security context, the evidence pipeline, configuration, the tenant model and the release registry — this capability also depends on:
- Microsoft Entra and Azure integration packages.
8. What is still open
The following are genuinely undecided rather than merely undocumented, and each one changes what the capability is:
- Whether drift detection is authoritative enough to fail a deployment or only to report.
- How enforcement coverage is measured — per service, per method, or per protected resource. Per method is the honest unit and the hardest to collect.
- Whether inventory is published as evidence or held as operational telemetry.
Every Q4 2026 extension is also held to four platform-wide requirements, six test classes and four release gates. They are published once, on the Q4 2026 roadmap, rather than repeated on every page.