When to use: Regulated organizations (DORA / GDPR-class) that require Blekline control plane inside their VPC, customer-held keys, dual-control enforcement, and evidence exports for committee review.
Architecture
flowchart TB
subgraph vpc [Customer VPC]
Sidecar[NHIM sidecar + admission]
Vault[PVC vault customer KMS]
EBPF[eBPF audit plane optional]
Sidecar --> Vault
EBPF --> Sidecar
end
IdP[Enterprise IdP SAML/SCIM] --> Sidecar
Honesty: eBPF sees sockets and exec metadata — not TLS plaintext. Kernel-plane enforce requires dual control.
Prerequisites
- Enterprise eval or production SOW
- OpenShift or private K8s cluster
- Named security + platform contacts for dual-control activation
Install
- Start [eval journey](/docs/get-started/eval-journey) — upload NHIM audit in Deployment hub.
- Deploy sidecar Helm pack with
enforcementStage: auditdefault. - Configure OpenShift SCC / Istio exclusions per runbook (design partner checklist).
npx @blekline/init --path in_vpc
# maskBackend: sidecar — never hosted /api/mask
Verify
- NHIM audit gaps addressed or documented as accepted risk.
- Would-deny events visible in Runtime log while in audit mode.
- Evidence export pack generates without raw prompt storage.
Operate
| Stage | Behavior |
|---|---|
| Audit (default) | Log would-deny; no block |
| Enforce | Requires two admins; air-gap token when controlPlane.mode=local |
| Hosted mask | Disabled — sidecar only |
SAML/SCIM and eBPF enforce are roadmap-gated per your contract — see claim integrity.