Glossary

Agentic privilege escalation occurs when an AI agent obtains or uses capabilities beyond its intended scope — often via prompt injection, tool chaining, or leaked credentials in context. Runtime policy and lineage controls reduce blast radius.

The Lineage Firewall tracks session context across tool calls and blocks destructive actions when a session is contaminated — for example after indirect prompt injection. It complements static tool allowlists with stateful intent memory.

NHIM is Blekline's category for governing autonomous agents at the execution boundary — who the agent is, what tools may run, and whether session lineage permits action. It complements human IAM with stateful runtime enforcement.

A Non-Human Identity (NHI) is a machine identity used by software agents, services, and automation — not a human user account. NHIs need runtime enforcement because static entitlements do not observe what agents actually do in production.

Runtime agent enforcement evaluates and controls tool calls, prompts, and egress while an agent is executing — not only at login or API gateway time. Blekline applies allow, mask, or block decisions before downstream systems act.

Shadow AI agents are unsanctioned autonomous workflows connecting to production data or tools without central governance. Ingress and sidecar enforcement provide visibility and policy at the agent boundary.

Trust Vault is Blekline's stateful tokenization layer: sensitive values are replaced with cryptographic placeholders before LLM context, then re-hydrated in-cluster on approved tool calls. Placeholders use the BLW_VAULT_* format.

Zero Standing Privilege for AI means agents receive short-lived, task-scoped credentials rather than persistent broad access. Blekline supports ZSP patterns via Trust Vault tokenization and workload identity binding (roadmap: SPIFFE).