Architecture & Governance

Dual-JSON contracts with deterministic safety guarantees

Instead of trusting arbitrary HTML strings or brittle page builders, Section Blocks isolates structural AST templates from validated copy and enforces every boundary on the server.

Inspect in Live CMS API Reference

01 · Dual-JSON Section Contract

Two JSON objects per section. Zero overlap.

When an editor saves copy, only the content dictionary is validated and stored. When a developer refactors responsive utility classes, bound content across pages remains untouched.

template.json — Structural Tree & Slot Pointers

{  "tag": "section",  "attrs": { "class": "mx-auto max-w-5xl py-16 px-6" },  "children": [    {      "tag": "h2",      "attrs": { "class": "font-heading text-3xl font-semibold tracking-tight" },      "children": [{ "contentId": "section_title" }]    },    {      "tag": "p",      "attrs": { "class": "mt-3 text-muted-foreground" },      "children": [{ "contentId": "section_body" }]    },    {      "listView": "faq-accordion-list"    }  ]}

content.json — Keyed Value Dictionary

{  "section_title": {    "id": "section_title",    "name": "Section Title",    "value": "Technical governance without editorial gridlock."  },  "section_body": {    "id": "section_body",    "name": "Section Lead",    "value": "Every heading, link, and list item binds into pre-approved markup."  }}

Recursive Node Bindings

Text nodes, anchor hrefs, and img src/alt bind explicitly to {"contentId": "..."} so every string has one provenance.

Repeatable View Mounts

{"listView": "slug"} mounts a typed Record List inside a structural slot without flattening lists into static paragraphs.

Clean Diffs in Version Control

Because layout structure and copy are stored separately, design updates never collide with marketing text edits.

02 · Server-Enforced Sanitization

Strict HTML & Attribute Allowlist

No regex blacklists. Section Blocks validates every template tree against an explicit schema before persistence and again during public rendering.

All Text Nodes Escaped

Category	Permitted Tags	Permitted Attributes	Validation Rules
Structural Containers	section, div	class	Layout wrappers and responsive grid/flex containers
Typographic Hierarchy	h1, h2, h3, h4, h5, h6, p, span	class	Headings, body paragraphs, and inline eyebrow badges; all text escaped
Navigation & Links	a	class, href	Validated to allow only https:// URLs or internal / paths; javascript: blocked
Lists	ul, ol, li	class	Ordered and unordered structural lists; repeatable Record Lists mount via listView
Media	img	class, src, alt	Strict https:// image sources and accessible alt text; no raw SVG scripts

Explicitly Blocked by Schema Validation

Raw HTML blobs, <script>, <iframe>, inline style="" attributes, and DOM event handlers (onclick, onerror, etc.) are rejected with HTTP 400 before any database write occurs.

03 · Save Boundaries & Concurrency

Zero silent clobbers across multi-user teams

Section Blocks separates content mutation permissions from template mutation endpoints, and checks expected timestamps on every save to prevent stale tabs from overwriting freshly published work.

Role-Isolated Save Endpoints

An Editor never posts structural template JSON in their save payload—meaning no UI bug or modified client request can alter page layout tags.

Optimistic updatedAt Checks

Concurrent writes return HTTP 409 Conflict with the latest server revision so teams never silently erase each other's edits.

Optimistic Concurrency & Boundary Contract

// Content-only save boundaryPUT /api/projects/:projectId/sections/:sectionId/content{  "expectedUpdatedAt": "2026-11-15T14:22:08.114Z",  "content": {    "section_title": { "value": "Updated campaign headline" }  }}
// Response when another teammate saved newer edits first:HTTP 409 Conflict{  "error": "STALE_WRITE_DETECTED",  "currentUpdatedAt": "2026-11-15T14:24:19.002Z"}

04 · Role-Based Access Control

Least-privilege governance per project workspace

Assign granular roles to every teammate at cms.sectionblocks.com so agencies, contractors, and internal writers collaborate safely.

Role	Typical Collaborator	Content Edits	Template JSON	Pages & Sitemap	Publish Snapshot	Members & Settings
Viewer	Stakeholders & QA
Editor	Marketing & Content Writers
Developer	Frontend & Design Systems
Publisher	Release Managers
Admin	Workspace Owners

cms.sectionblocks.com

Verify Section Blocks architecture in your own workspace

Inspect Dual-JSON templates, test role permissions, and generate your first immutable snapshot on cms.sectionblocks.com.

Create Free Workspace Tour Editor Features Sign in →