Activity-based, data-aware authorization (ADA)

ADA is B5 Secure’s signature capability. It authorizes the operation and the data it touches — not just “is this user logged in?” but “is this identity permitted to perform this action on this record?”

The secure default

By default, an authenticated identity must possess a unique permit for every action (web operation), and must be permitted on the specific entity referenced in the request. This holds with little to no application code — the convention does the work.

How it works

You annotate operations with the action and entity they concern; B5 Secure resolves the referenced id from the request and checks the identity’s permits against it.

[Protect]
[Permission("interaction.create")]
[AuthEntity(typeof(Contact))]  // id resolved from the request
public OpResult Record(CreateInteraction req) { ... }

Overriding the conventions

The defaults are conventions, not a cage. You can:

• Point ADA at a different id member with a references provider.
• Exempt an action with [SkipActivityAuthorization] or [DoNotAuthorize] — explicit and auditable.
• Implement IEntityIdAuthorizer for custom record-level rules.

Data-aware response shaping

ADA pairs naturally with the fourth Never Trust tenet — limit returned data. Use permits to decide whether a caller receives a summary or a detailed view, so an endpoint never over-returns to an identity that lacks the privilege.