Definitions · R · Runtime enforcement
Runtime Agent Enforcement
Runtime agent enforcement evaluates and controls tool calls, prompts, and egress while an agent is executing — not only at login or API gateway time. Blekline applies allow, mask, or block decisions before downstream systems act.
Runtime agent enforcement governs what happens while an agent executes — tool calls, prompt egress, and sandbox boundaries — rather than only at authentication time.
Enforcement outcomes
| Outcome | Meaning |
|---|---|
| Allow | Proceed with optional metadata logging |
| Mask | Replace sensitive spans before downstream |
| Block | Stop call; surface in runtime log |
Surfaces
- MCP:
blekline_evaluate_tool_call, MCP proxy - SDK:
/api/mask,/api/ingress/v1/* - Sidecar: mandatory hop on agent pod network path
In Blekline
- Policy editor:
/operations/policies - Live events:
/operations/activity - Simulator: /docs/playground/runtime-enforcement