Glossary

Agentic privilege escalation occurs when an AI agent obtains or uses capabilities beyond its intended scope — often via prompt injection, tool chaining, or leaked credentials in context. Runtime policy and lineage controls reduce blast radius.

Blekline platform eval is organized in three tracks: Track 01 (Kubernetes fleet), Track 02 (Docker sidecar), Track 03 (MCP integrator). Each track maps to a deployment hub checklist and evidence export path.

The eval journey is Blekline's structured path for security architecture review — NHIM audit, sidecar or MCP wiring, runtime log review, and compliance export. It is evidence enablement, not certification.

Ingress masking redacts or tokenizes sensitive values in prompts and tool arguments before they reach models, sandboxes, or downstream MCP servers. Blekline applies mask decisions at the MCP proxy, SDK, and `/api/ingress/v1/*` boundary.

The Lineage Firewall tracks session context across tool calls and blocks destructive actions when a session is contaminated — for example after indirect prompt injection. It complements static tool allowlists with stateful intent memory.

A mandatory hop requires agent traffic to pass through Blekline ingress (sidecar or MCP proxy) before reaching models, tools, or the public internet. Fleet benchmarks (B6) verify agents cannot bypass the hop.

The Blekline MCP proxy sits between an agent client and downstream MCP servers — evaluating tool calls against workspace policy before execution. It is the primary governance surface for Cursor, Claude Code, and Codex integrators.

Metadata-only audit means default telemetry exports tool names, risk tiers, policy rule IDs, and lineage references — not prompt bodies or customer PII. SIEM, Slack, and compliance pack exports follow this contract unless explicitly opted in.

NHIM is Blekline's category for governing autonomous agents at the execution boundary — who the agent is, what tools may run, and whether session lineage permits action. It complements human IAM with stateful runtime enforcement.

NHIM audit is a static Kubernetes cluster scan (`nhim-audit` CLI) that inventories agent workloads, egress paths, and sidecar coverage before Blekline deploy. Output JSON feeds the deployment hub posture upload.

A Non-Human Identity (NHI) is a machine identity used by software agents, services, and automation — not a human user account. NHIs need runtime enforcement because static entitlements do not observe what agents actually do in production.

Platform eval is Blekline's enterprise trial mode — eval workspace, deployment hub tracks, NHIM posture upload, and compliance export without implying SOC 2 or pentest completion. Billing gates relax for SIEM, Slack, and vault preview.

Runtime agent enforcement evaluates and controls tool calls, prompts, and egress while an agent is executing — not only at login or API gateway time. Blekline applies allow, mask, or block decisions before downstream systems act.

Shadow AI agents are unsanctioned autonomous workflows connecting to production data or tools without central governance. Ingress and sidecar enforcement provide visibility and policy at the agent boundary.

Trust Vault is Blekline's stateful tokenization layer: sensitive values are replaced with cryptographic placeholders before LLM context, then re-hydrated in-cluster on approved tool calls. Placeholders use the BLW_VAULT_* format.

Zero Standing Privilege for AI means agents receive short-lived, task-scoped credentials rather than persistent broad access. Blekline supports ZSP patterns via Trust Vault tokenization and workload identity binding (roadmap: SPIFFE).