Authorize every action, every time — at the line of code where it executes.
Authenticate-once-and-trust-the-session is a liability the moment callers act at machine speed. Continuous authorization moves the decision past login into per-action, attribute-aware evaluation at the exact moment a tool or API is invoked. B5 makes that runtime plane a declarative .NET primitive — continuous authority is only as strong as its last enforcement point.
The gateway said yes. The code that moves money forgot to re-check.
Control planes and IdPs decide at the edge and hand your application a token. The action still executes deep inside your code, often guarded by hand-written checks that drift, miss edge cases, or were never written. Between the edge decision and the method that commits the transaction lies the gap where breaches happen. Continuous authorization closes it by evaluating the decision where the action runs — every call, with current attributes and risk.
Trust the session
- Decision made once, at login, at the edge
- Enforcement left to hand-written downstream checks
- Risk changes mid-session with no re-evaluation
- A revoked privilege keeps working until the session ends
Continuously enforce
- Decision re-evaluated per action, at the call site
- Enforcement bound to the method via [Permission]
- CAEP/SSF risk signals admitted as live policy inputs
- Continuous Access Evaluation revokes in near-real-time
The [Permission] attribute is the runtime decision plane.
Because B5 compiles into your application, the per-action check executes in-process on every call — no network round trip, no external store, no gap between decision and enforcement.
Per-action evaluation
Every protected method carries a declarative [Permission]; the decision is made at invocation, not inherited from a stale session.
Attribute- and relationship-aware
Far beyond RBAC: context, data scope, record- and field-level sensitivity, and relationships are evaluated per call. RBAC is the floor, not the ceiling.
Live risk inputs
CAEP/SSF and device or geo signals are admitted as policy inputs, so a risk spike changes the decision immediately.
Continuous Access Evaluation
Active sessions are revoked in near-real-time when a decision changes — closing the window between a policy change and its enforcement.
In-process, no round trip
The decision is evaluated where the method runs, inside your boundary — no external authorization service on the hot path.
Provable at the execution point
Each decision is logged at the precise method that ran, producing the highest-fidelity audit record for examiners.
[Permission("orders.approve", Risk = RiskPolicy.Adaptive)] public async Task ApproveAsync(OrderId id) { // Evaluated every call: the caller's current scope, the record's // attributes, and live CAEP/SSF risk signals. A mid-session risk // spike flips this decision to deny — no session waiting required. await _orders.ApproveAsync(id); }
Continuous authority where the action commits.
Step-up at the threshold
A transaction under a ceiling passes; above it, the same method demands a step-up factor evaluated as a policy attribute.
Revoke without waiting
A compromised-credential signal revokes an active session in near-real-time via Continuous Access Evaluation.
Machine-speed, still governed
Thousands of agent actions per hour, each re-authorized at the call site against current scope and risk.
Continuous authorization complements your control plane.
Decide and detect across the estate; enforce in the .NET tier.
Your control plane and risk engines remain necessary — they decide and detect across workforce, customer, and agent traffic. B5 is the runtime enforcement plane those decisions land on. It admits their CAEP/SSF signals as inputs and makes the resulting decision binding at the method. The decision layer is only as strong as its last enforcement point; B5 is that point.
The platforms decide. B5 enforces — at the line of code where the action happens.
See how per-action authorization compiles into your .NET applications, with no external store and no hot-path round trip.