Aggressively verify every request.
Zero assumed trust means every request earns its access through the full series of checks — no undocumented switches, no internal-only exemptions. Absence of evidence must always mean absence of access.
1. Why per-request, every time
Trust granted once and remembered is trust an attacker can inherit. A session that is validated at login and then assumed for an hour is an hour-long window for a stolen token. Per-request verification removes that window: identity, integrity, and authorization are re-established on every call, so a credential that becomes invalid — revoked, expired, or flagged — loses access on the very next request, not at the next login.
2. The full series of checks
“Verify” is not a single gate; it is an ordered pipeline, and every stage must pass:
- Identity — who is calling, proven by a signature, key, or session, not asserted by a header;
- Integrity — the request arrived unaltered and within its time window, defeating replay and tampering;
- Authorization — this identity may perform this action on this specific record;
- Posture — the identity is not suspended and its behavior has not tripped a policy.
A request that cannot satisfy a stage does not proceed to the next one.
3. No exemptions, no back doors
The most exploited weakness in otherwise-secure systems is the exemption — the “internal only” route, the debug flag, the partner endpoint that skips a check “because it is trusted.” Attackers find these first, precisely because they are the paths the designers stopped scrutinizing. Aggressive verification means the pipeline has no documented or undocumented bypass: the rule that protects the customer-facing API protects the internal one identically.
4. How B5 Secure enforces it
In B5 Secure, verification is the request pipeline itself, configured once and applied uniformly. Authentication, request-integrity and replay protection, data-element authorization, and suspension checks run as ordered stages on every request, for every identity type — browser session, service key, or signed machine call. Because the checks are pipeline configuration rather than per-controller code, there is no handler that can quietly forget one, and no “internal” path that runs a shorter version of the gauntlet.