Decisions that reach live sessions.
A revocation is only as fast as the moment it actually reaches the attacker’s session. The 2026 extension moves hierarchy-aware suspension rules into a versioned policy engine and pairs them with Continuous Access Evaluation, so a decision propagates to active sessions in near-real-time — closing the gap between “we decided to revoke” and “the token stopped working.”
1. The gap between a decision and its effect
Token-based access has a structural latency problem. An access token is, by design, valid until it expires — that is what lets you avoid a database lookup on every request. But it also means a revocation decided at 10:00 may not bite until the token expires at 10:15. For most systems that window is an annoyance; for a payments or custody platform reacting to fraud or a sanctions hit, fifteen minutes is fifteen minutes too many. The decision is correct and instant; its effect is late.
2. A versioned policy engine
The first half of the 2026 extension moves the hierarchy-aware exclusion rules from Rules-Based Suspension into a dedicated, versioned policy engine — Cedar or Rego. The rules become human-readable, independently testable artifacts with a change history, rather than logic embedded in application code. Versioning matters for more than tidiness: when a reviewer asks “what policy was in force when this request was denied?”, you can answer with a specific, immutable version rather than a guess about the deployed build.
Externalizing the policy does not weaken the pipeline’s authority. The engine produces the decision; the B5 pipeline remains the enforcement point that applies it on every request. Policy and enforcement stay cleanly separated.
3. Continuous Access Evaluation
The second half closes the latency gap. Continuous Access Evaluation (CAE) lets the issuing authority and the resource react to critical events — a suspension, a credential revocation, a risk change — by invalidating active sessions in near-real-time instead of waiting for token expiry. A revoked session stops working on its next request, not at the end of its lifetime. The long-lived-token performance win is preserved for the common case, while critical events get short-circuit revocation.
4. How the two fit together
A signal — fraud, KYC, OFAC — updates state. The versioned policy engine evaluates the new state into a decision. CAE propagates the consequence to live sessions, and the B5 pipeline enforces it on the next call from any of them. The same machinery integrates with detection and response (for example, Microsoft Sentinel automation) so that a detection can drive a revocation without a human in the critical path when the situation warrants it.
5. The calling convention
Rules live in the engine; CAE is wired as the propagation channel; enforcement stays in the pipeline.
// Versioned policy decision + near-real-time propagation to live sessions
services.AddB5SecurityKit(o => {
o.Suspension.PolicyEngine = Pdp.Cedar(version: "2026.06"); // or Rego
o.Suspension.Cae = ContinuousAccess.Enabled;
o.Suspension.Propagation = TimeSpan.FromSeconds(5); // target revocation latency
});
// A fraud detection drives a revocation; CAE kills active sessions next request
suspensions.Apply(suspension); events.Raise(CaeEvent.SessionsRevoked(subject));6. What an attacker actually gets
An attacker riding a session that was valid a moment ago loses it on the next request once the suspension is applied — there is no fifteen-minute grace period to drain an account. Because the policy is versioned, the attacker cannot benefit from ambiguity about which rule applied; the decision is deterministic and recorded. And because enforcement remains in the pipeline, there is no resource that honors the stale token after the revocation event.
7. Where this lands in an audit
CAE and versioned policy are the strongest possible answers to timeliness of access revocation and policy governance questions (SOC 2 CC6.2–CC6.3, CC7.3; ISO 27001 A.5.18, A.8.16; NIST CSF DE.AE / RS.MI). You can evidence not only that access was revoked, but how quickly the revocation reached live sessions and exactly which policy version produced the decision — the difference between a control that exists and one that demonstrably works in time.