Release v22.23.0

Added

• Register scoped, asynchronous authorization policies with IAuthorizationPolicy and AddArcAuthorizationPolicy<TPolicy>() on either Arc host (#2736).
• Use ASP.NET Core policies and authentication schemes on model-bound commands, queries, and observable subscriptions, following the authorization contract (#2736).

Fixed

• Observable streams retain their identity and service lifetime through in-flight emissions, including disconnects and failing cancellation or disposal callbacks.
• Authorization diagnostics now describe contradictory attributes accurately; ARC0021 is limited to authentication schemes without Arc’s ASP.NET Core integration.

Security

• Policy and AuthenticationSchemes no longer silently fall back to authentication-only checks. Unknown, ambiguous, malformed, or unsupported requirements fail closed; applications using previously ignored settings must register valid policies and schemes before startup (#2736).
• Scheme-selected execution isolates the effective principal, tenant, and scoped services. Unsafe caller-supplied providers and identity-changing nested scheme calls are rejected rather than reusing services bound to another identity. Standalone Core does not support named authentication schemes (#2736).