Seven Field-Proven Authorization Patterns The seven ways authorization fails, and the repeatable answer to each.
Seven Field-Proven Authorization Patterns explains why authorization failures recur across enterprise applications and how B5 Secure addresses them with repeatable, fail-closed mechanisms: grant catalogs and role bundles, decision ledgers, complete passkey ceremonies, immediate session revocation, bounded AI-agent authority, versioned security-event exports, and the startup authorization completeness gate. Together the seven compose into the B1–B5 pipeline for .NET 10.
What’s inside
The sections, in the order the paper makes its argument.
- Pattern 1 — Grant catalog and role bundles: permissions you can enumerate
- Pattern 2 — Decision ledger: every decision leaves evidence
- Pattern 3 — Passkey ceremonies validated completely
- Pattern 4 — Session doctrine: suspension and revocation take effect immediately
- Pattern 5 — Agent authority: bounded, delegated, never inherited
- Pattern 6 — Versioned events: exports that survive release day
- Pattern 7 — Completeness: no endpoint ships without a check
- How the seven compose onto the pipeline and the adversaries they contain
Who it’s for
Three readers, three reasons.
Application security engineers
Each pattern names the threat, the mechanism and its failure behaviour — always fail closed.
Platform and DevOps teams
The completeness gate and versioned events are CI concerns as much as runtime ones.
Architects evaluating B5SecurityKit
Every pattern is a component of the kit for .NET 10; the paper is the map.
Get the paper
Enter your work e-mail and we send a download link, valid for 72 hours. No attachments, no drip campaign — one message with the paper.
Get the document
Discover seven field-proven mechanisms that close recurring authorization gaps and compose into B5 Secure’s fail-closed B1–B5 enforcement pipeline for .NET 10.
Companion reading
The three papers are written to be read together.
Never Trust
v1.4 · 31 pages — Continuous authorization from the record down to the data element.
Authorize the Data Element Before the Request Happens
v1.1 · 12 pages — The mechanism: what decides, at which point, with which defaults, what it costs, and what it writes down.
The Never Trust overview
The doctrine in one page, and the six principles behind it.
Figures cited in the papers describe the security and processing-integrity record of the lineage platform (first deployed to Forge Trust, now owned by Charles Schwab) as of December 31, 2025 — $16B+ in assets, 2.3M+ accounts, $0 of loss to security or processing-integrity failure. They are not a claim that B5SecurityKit is deployed at any named institution today.
Read it, then see it run.
The pipeline the paper describes is what the demos execute.