Known networks, stepped-up actions.
B3 enforces network allow-lists per identity and demands step-up verification on high-impact actions. Requests from outside an identity’s permitted networks are denied; sensitive operations require a second factor even from a permitted one — defense that scales with the stakes of the action.
1. Why bind identities to networks
Most credentials have a knowable home: a service runs from known ranges, an administrator connects from a known network. B3 makes that expectation enforceable — a static, deny-by-default IP allow-list per identity, evaluated across the whole pipeline. When the network does not match, the request is denied before authorization is ever consulted.
2. Step-up on impact, not on everything
Friction belongs where the stakes are. B3 reserves multi-factor step-up for high-impact actions — changing security settings, moving value, granting access — rather than taxing every read. The result is strong assurance exactly where a mistake or a compromise would hurt, without training users to click through prompts on routine work.
3. Fail-closed and the static core
The allow-list is the strict ground truth: it can be tightened by adaptive layers but never relaxed by them. If a step-up challenge cannot be completed or evaluated, the sensitive action is denied. This is the same deny-union discipline the adaptive identity firewall builds on — the core holds the hard line.
4. The calling convention
Network policy and step-up thresholds are declared as policy; enforcement is uniform.
// B3 — static allow-list plus risk-gated step-up
services.AddB5SecurityKit(o => {
o.Firewall.AllowList = IpPolicy.PerIdentity("deny-by-default");
o.Mfa.StepUpOn = Impact.High; // settings, value, access changes
o.Mfa.OnChallengeFail = FailMode.Closed;
});5. What an attacker actually gets
A stolen service credential used from the wrong network is denied by the allow-list; a phished interactive session that tries a high-impact action is stopped at step-up; an attacker who clears one factor still faces the second exactly where it matters most. The blast radius of a single compromised credential is bounded by both where it can be used and what it can do unchallenged.
6. Where this lands in an audit
B3 is the evidence for network access control and multi-factor authentication (NIST CSF PR.AA, PR.IR; SOC 2 CC6.1, CC6.6; ISO 27001 A.8.5, A.8.20). The story is layered and legible: known networks for what can be enumerated, a second factor for what would hurt.
Next: B4 · Verification & Suspension — only live identities proceed →