The Never Trust pipeline, extended for 2026.
B5 Secure keeps every stage of the fail-closed pipeline that protected ISCP — now A8 Core™ — and extends five of them with today’s standards: standardized request signatures, phishing-resistant passkeys, externalized fine-grained authorization, an adaptive identity firewall, and continuous policy-driven suspension. Every extension is additive, flag-gated and behavior-preserving — the proven contract never changes.
The same pipeline, with a 2026 edge on each stage.
Each stage keeps its current behavior as the default and gains a modern, standards-aligned capability you opt into. Nothing is ripped out; everything is added behind a flag.
HMAC request signing
Today: keyed HMAC over URL, method, body, timestamp, nonce & AuthUrn.
2026: an RFC 9421 HTTP Message Signatures profile, an ML-DSA post-quantum option, and HSM keys by reference.
Read the whitepaper →Multi-factor
Today: pipeline-enforced second factor, email codes, per-session or inactivity expiry.
2026: FIDO2/WebAuthn passkeys, TOTP authenticator apps, and risk-based step-up.
Read the whitepaper →Granular authorization
Today: ADA — activity-based, data-aware, convention-driven, with implied permissions.
2026: an AuthZEN PEP that can externalize to OpenFGA (ReBAC) or Cedar/Cerbos (PBAC).
Read the whitepaper →IP firewall
Today: static IP allow-lists per identity, enforced across the pipeline.
2026: an adaptive identity firewall — geo/ASN, threat-intel deny feeds, rate limits, device posture, WAF.
Read the whitepaper →Rules-based suspension
Today: user & entity suspension with hierarchy-aware exclusion rules.
2026: a policy engine, Continuous Access Evaluation, and SIEM-driven automation.
Read the whitepaper →Co-hosted, one host
All of it runs behind a single B5 Secure pipeline on .NET 10 — ASP.NET Core minimal APIs and GraphQL alongside co-hosted ServiceStack v10, sharing the same schemes, keys and telemetry.
Read the whitepaper →Fine-grained access, the standards way.
ADA stays the embedded default decision engine — battle-tested, data-aware, convention-based, with implied permissions that retire roles. What’s new is the seam: the authorization stage becomes an OpenID AuthZEN 1.0 Policy Enforcement Point. When a decision is better expressed elsewhere, B5 asks an external Policy Decision Point — without rewriting application code, and without locking into one engine.
Behind that one interface you can run ReBAC (OpenFGA — CNCF, Zanzibar-style relationship graphs), PBAC/ABAC (Cedar, Cerbos, Rego), or keep ADA. That is how you express “advisor X manages account Y,” “a TPA may view provider Z,” or “a user may read a document if they can read its parent folder” — relationships a hierarchy doesn’t natively model — while every decision still flows through the same fail-closed pipeline.
AuthZEN keeps the request/response contract consistent, so a PEP built today can talk to tomorrow’s policy engine with no code change.
// ADA stays default; externalize per-operation when you want
services.AddB5SecurityKit(o => {
o.Authorization.DefaultDecision = Pdp.Ada; // embedded, data-aware
o.Authorization.External = AuthZen.OpenFga("https://pdp");
o.Authorization.Externalize("Account.Transfer"); // opt-in, ReBAC
});| Model | Engine | Where it fits |
|---|---|---|
| ADA activity + data-aware | B5 built-in | Default; property-level checks on operations & records |
| ReBAC relationships | OpenFGA | Graph permissions: ownership, delegation, inheritance |
| PBAC / ABAC policies & attributes | Cedar · Cerbos | Attribute and context rules, versioned in Git |
| RBAC roles | any of the above | Covered as a subset — ReBAC supersets RBAC |
HMAC, now an interoperable standard.
B5’s HMAC scheme already binds each request to a single operation and record with a keyed hash over identity, timestamp, route and body, defeating replay and tampering. The extension keeps that strictness and adds an RFC 9421 HTTP Message Signatures profile — so partners integrate with off-the-shelf libraries instead of a bespoke client.
For long-lived data it offers an ML-DSA (FIPS 204) post-quantum signature option, with keys held by reference in a FIPS 140-3 Level 3 HSM and a distributed nonce store for replay protection at scale.
// Scheme negotiation — legacy and RFC 9421 side by side
services.AddB5SecurityKit(o => {
o.Signing.Signature = SigningScheme.Rfc9421; // or .B5Classic
o.Signing.Algorithm = HmacAlg.HmacSha384;
o.Signing.PqcOption = Pqc.MlDsa65; // FIPS 204
o.Keys.Source = KeySource.AzureManagedHsm;
o.Signing.NonceStore = NonceStore.Redis;
});Illustrative configuration. Names follow the B5 Secure options surface.
From email codes to phishing-resistant.
FIDO2 / WebAuthn, device-bound and phishing-resistant — the headline upgrade for custody.
RFC 6238 authenticator apps with recovery codes for broad compatibility.
Risk-based challenges on new device, geo, ASN or sensitive operation.
Same once-per-session / inactivity semantics — methods plug into the existing MFA stage.
Passkeys, TOTP and risk-based step-up.
The pipeline already enforces a second factor as its own stage. The extension adds modern FIDO2/WebAuthn passkeys and TOTP as first-class methods, and lets the stage demand step-up dynamically on a risk signal — not just once per session.
Email codes remain available for fallback, but passkeys make the most sensitive operations resistant to phishing and credential replay by design.
Adaptive at the edge, continuous over time.
Adaptive identity firewall
The static allow-list stays the strict core. Layered on top: geo/ASN rules, auto-expiring threat-intel deny feeds, per-identity and per-endpoint rate limits, device-posture signals for high-value accounts, and Azure Front Door / WAF at the edge. Static semantics are preserved when the new providers are off.
Policy-driven suspension & CAE
Your hierarchy-aware exclusion rules move into a versioned policy engine (Cedar / Rego). Continuous Access Evaluation revokes active sessions in near-real-time on a risk event — password change, geo anomaly, KYC failure — rather than waiting for token expiry, and Defender / Sentinel can trigger guarded, rule-governed suspension automatically.
Open standards, not a proprietary corner.
Each extension is anchored to a published specification — so interoperability, audit and longevity come built in.
| Capability | Standard / spec | What it gives B5 |
|---|---|---|
| Request signing | RFC 9421 | Interoperable HTTP Message Signatures partners can consume with stock libraries |
| PQC signatures | FIPS 204 / 203 | ML-DSA & ML-KEM for post-quantum integrity and key exchange |
| Passkeys | W3C WebAuthn / FIDO2 | Phishing-resistant, device-bound multi-factor |
| Authenticator apps | RFC 6238 | Broadly compatible TOTP second factor |
| Authorization interface | OpenID AuthZEN 1.0 | Standard PEP ↔ PDP contract; engine-agnostic, no lock-in |
| Relationship authz | OpenFGA (Zanzibar) | ReBAC graph permissions at scale (CNCF) |
| Policy authz | Cedar · Rego | Versioned PBAC/ABAC policy, reviewed like code |
| Session revocation | Continuous Access Eval. | Near-real-time revocation on risk events |
Behavior-preserving, flag-gated, human-reviewed.
Nothing destabilizes the proven pipeline. Each track lands on the same disciplined path — the security contract is the definition of done.
Pin the contract
A golden-master suite captures known-good signatures, per-scheme auth decisions, and every MFA, verification, suspension and ADA branch — before a line changes.
Add behind a flag
Every extension ships behind a feature flag that defaults to current behavior. Tests prove parity when off and the new capability when on.
Externalize, opt-in
ADA stays the default decision engine; specific operations route to an AuthZEN PDP only where relationship or policy rules earn it.
Continuous & automated
CAE and SIEM automation turn risk signals into near-real-time revocation and guarded suspension — with a human in the loop for anything irreversible.
Review the sensitive paths
No cryptographic, authentication or access-widening change merges without human review against the golden suite.
Proven pipeline. 2026 standards.
Take the Never Trust engine that secured $15B+ in custody and extend it — signatures, passkeys, fine-grained authorization, adaptive firewall and continuous suspension — without changing what already works.