BaaS Blocks
The BaaS blocks are the backend an enterprise application needs, as composable services rather than a framework. Each is configured in YAML, extended with scripts, and isolated per tenant.
The blocks
Section titled “The blocks”Foundation
Section titled “Foundation”| Block | What it does |
|---|---|
| IAM | Identity, authentication, authorization, tokens and realms |
| Data API | Entities, REST and GraphQL over your data model, with lifecycle and extension points |
| Config | Configuration and service discovery for every other block |
| Vault | Secrets, certificates and signing, with a per-node agent |
| Meta | The product model — what your application is made of |
Edge and delivery
Section titled “Edge and delivery”| Block | What it does |
|---|---|
| Gateway | TLS termination, routing, static files and WebSockets |
| BFF | One endpoint per screen, stitched from several backends |
| Script | Sandboxed multi-language execution of tenant code |
| Sandbox | OS and VM isolation — process, WASM, host, container and microVM tiers |
| Content | Headless content management with typed models and asset stores |
| Intake | Form capture at the edge |
Process
Section titled “Process”| Block | What it does |
|---|---|
| Workflows | Long-running processes that suspend, wait for humans and resume |
| Jobs | Scheduled and triggered background work on a fleet of agents |
| Rules | Document and data rules — extraction, matching, validation |
| Data Pipes | ETL pipelines over your data |
| Integrate | Named connections to third-party systems |
| Notifications | Omni-channel dispatch with routing, suppression and an outbox |
Governance
Section titled “Governance”| Block | What it does |
|---|---|
| Audit | Tamper-evident audit trail |
| Usage | Telemetry and time decomposition — human vs AI vs idle |
How they fit
Section titled “How they fit”Most applications sit on the foundation blocks and add from the others as needed. Two dependencies are worth knowing about because they are not optional:
Config and discovery come first. Every block resolves its configuration and finds its peers through Config. It is the block that has to be up before anything else is meaningful.
Secrets never live in configuration. Credentials are vault: references resolved from
Vault at the point of use, which is why no block’s YAML contains a
literal key.
Choosing between the process blocks
Section titled “Choosing between the process blocks”Four blocks run multi-step work and they are not interchangeable:
| Use | When |
|---|---|
| Jobs | Fire-and-finish background work, on a schedule or a trigger |
| Workflows | Business processes that suspend, wait for a human, resume |
| Data Pipes | Moving and transforming data in bulk |
| AI Flow | Task DAGs including model calls, and agentic loops |
The line that matters most: a job is fired and runs to completion; a workflow waits. If the process pauses for a human and resumes days later, it is a workflow.