Real-Time Content Protection
Per-article, per-user encryption with revocation that lands in under a second.
Sub-second
Revocation propagation
7
Bot categories blocked
1,000+
Hours automated yearly
Agentic editorial pipeline
See it work
The problem
Publishers were losing content to scrapers and unauthorized bots that consumed articles at machine speed. Blocking by IP or user agent was trivially evaded, and once content had been served in the clear it was already gone.
Approach
Content is encrypted with a per-article data key, and that data key is itself wrapped by a customer master key held in AWS KMS. The application never handles the master key, so revoking access is a matter of refusing to unwrap rather than re-encrypting the article.
Authorization state lives in Redis so that every service reads the same answer within milliseconds of it changing. A revocation writes once and is observed globally on the next request, which is what makes sub-second propagation possible across service boundaries.
A classifier scores each request against seven distinct bot categories. Because the check sits in front of key unwrapping rather than inside the article renderer, a bot is stopped before any plaintext is produced.
Separately, an agentic content pipeline built on LangChain orchestrates multiple models behind automated review gates, removing over a thousand hours of manual editorial work a year.
Architecture
Decisions and tradeoffs
Envelope encryption over direct encryption
Per-article data keys wrapped by a KMS master key.
- Why
- Revocation becomes a key-access decision instead of a bulk re-encryption job, so it is fast and cheap no matter how large the article corpus is.
- What it cost
- Every read depends on KMS availability and adds an unwrap call to the hot path, which has to be budgeted for and cached carefully.
Redis as the authorization source of truth
Centralized grant state read by every service.
- Why
- Sub-second revocation across service boundaries is only achievable if no service is holding a stale local copy of the decision.
- What it cost
- Introduces a shared runtime dependency on the request path; it needs its own redundancy story or it becomes the outage.
Classify before decrypting, not after
Bot scoring runs ahead of key unwrapping.
- Why
- Once plaintext exists, protection has already failed. Ordering the check first means a refused request never materializes readable content.
- What it cost
- A false positive blocks a real reader outright, so classifier precision matters more than recall in this position.