Consume SPIFFE workload identity — enforce it at the .NET call site.
Workload-identity standards mint and attest cryptographic identities for services, jobs, and agents. They issue identity; they do not enforce what that identity may do inside your application. Today, B5 Secure enforces that — per-action [Permission]/ADA authorization, in-process, at the method that runs, for whatever identity your app resolves. Native SPIFFE SVID consumption and OBO-awareness ship H2 2026, binding the attested identity directly into that same enforcement point.
Issuing a workload identity is not the same as enforcing its scope.
SPIFFE/SPIRE and non-human-identity vendors solve a real problem — replacing static, long-lived service credentials with short-lived, attested identities. But an attested SVID still has to be honored somewhere: the method that reads a balance or posts a transaction must check that this workload, with this identity, is authorized for this action. That enforcement is exactly what B5 supplies, in-process, in .NET.
From attested identity to enforced action.
B5 sits downstream of your workload-identity issuer, turning an attested SVID into a binding authorization decision at each protected method.
SPIFFE-compatible consumption
B5 consumes the SPIFFE/workload identity and binds it to the in-process authorization context for the life of the action — no parallel, weaker model for machines.
Ephemeral, single-use credentials
Short-lived identities that expire when the task completes, so a compromised workload context has nothing durable to replay.
Scoped service credentials
Service-HMAC and Service-Key bind a machine caller to specific operations — even a particular record id — with its own expiry, keeping a leaked credential’s blast radius small.
One pipeline for humans and machines
Site-to-site keys, feature keys, and user sessions are all first-class identities authenticated and authorized through the same pipeline.
Origin and network binding
Sensitive credentials are bound to known address ranges and origins, so a leaked key is useless from anywhere else.
Replay and tamper protection
Request integrity checks and short expiry windows defeat replayed or tampered machine-to-machine calls.
// TODAY — B5 enforces per-action [Permission]/ADA at the method, // for whatever identity your application resolves. // H2 2026 — native SPIFFE SVID consumption binds the attested // workload identity directly into this authorization context. [Permission("ledger.read")] public Balance GetBalance(AccountId id) => _accounts.Balance(id); // read-only workload: nothing more.
Machine identity, enforced where it acts.
Service-to-service scope
An attested service calls another; B5 enforces that its identity covers exactly the operation invoked.
Bound, expiring credentials
A scheduled job runs with a single-use credential scoped to its task and nothing else.
Workload-bound automation
A machine-bound agent inherits a SPIFFE identity and a narrow, pre-declared permission set enforced per call.
B5 consumes workload identity; it does not mint it.
Complementary to SPIFFE/SPIRE and NHI vendors.
Workload-identity issuers and non-human-identity platforms do the thing B5 does not: mint and attest the identity and manage its lifecycle. B5 does the thing they leave to your code — enforce the attested, scoped identity at the actual call site inside the .NET application. Run them together: issue and attest upstream, enforce in-process with B5.
Attested upstream. Enforced in your code.
See how B5 turns a SPIFFE SVID into a binding [Permission] decision at every .NET method — inside your boundary.