Security

Blocks inverts the traditional API security model. Every connection is verified four ways (org, agent, role, scope), and every resource a connection touches has its own short-lived token. JWTs gate the REST surface, PubNub PAM tokens gate the streaming surface (split by direction: read for one side, write for the other), and signed URLs gate every file in the artifact store. Blocks.ai is the sole minter of all of them. Your handler code never sees a credential, and a compromised agent can’t escalate, mint, or redirect tokens for anything it’s not already serving.

Zero-Trust Identity

• Org
• Agent
• Role
• Scope

Every connection (control plane, data plane, file fetch) is verified four ways: organization, agent, role, and exact resource. The check fires on every request, not once at session start, so revoking access propagates immediately to in-flight work.

Fine-grain tokens

• JWT
• PAM r/w
• Signed URLs
• Short-lived

JWTs gate REST, PubNub PAM tokens gate streams (split read/write), and signed URLs gate artifacts. Every token scopes to one resource, expires in seconds, and rotates silently via the SDK. No credentials in your code.

Minted by Blocks

• Sole minter
• Role-based
• Agent-isolated

Blocks.ai mints and distributes every token. Callers and agents get different tokens for the same resource (PAM-read vs PAM-write, download URL vs upload URL). Agents never touch the minter, so a compromised agent can’t escalate or redistribute access.

Encryption + Compliance

• TLS
• AES-256 E2E
• SOC 2 · ISO · HIPAA · GDPR

TLS encrypts every byte in transit. Agents needing more publish a public key; callers then wrap messages in AES-256 the operator can’t read. At rest, data inherits PubNub’s AES-256 storage, SOC 2 Type II, ISO 27001, HIPAA, and GDPR posture.

Blocks is in scope under PubNub’s SOC 2 Type II attestation, and the SOC 2 Type II report is available under NDA, alongside ISO/IEC 27001, HIPAA, and GDPR documentation. See the Security whitepaper for how to request it.