Enterprise implementation checklist

Linear runbook for regulated in-VPC pilots — platform and security teams implementing Blekline NHIM sidecar enforcement before production rollout.

Default posture: audit-only (log would-deny, no live block) until two admins activate enforce via the dashboard.

For IDE-heavy teams, run the Cursor DPO verification checklist in parallel on pilot laptops.

Honesty box

Full OWASP ASI + AIUC-1 control matrices ship in the enterprise sandbox (NDA) — see Compliance evidence.

Preconditions

npx @blekline/init --path in_vpc
# maskBackend: sidecar — never hosted /api/mask for production agents

Phase 1 — Posture and audit deploy

1. NHIM static audit — run [NHIM audit quickstart](/docs/get-started/nhim-audit-quickstart); upload JSON to Operations → Posture.
2. Resolve critical gaps — mandatory-hop bypass, missing sidecar, webhook not wired — before committee review.
3. Deploy sidecar (audit profile) — Helm with audit overlay:

helm upgrade --install sidecar blekline-ingress \
  -n blekline --create-namespace \
  -f deploy/k8s/sidecar/values-production.yaml \
  -f deploy/k8s/values-audit-profile.yaml

1. Pilot IDE laptops — if developers use Cursor, confirm hooks use sidecar mask (no double hosted /api/mask against production SaaS). See Cursor verification.
2. Collect would-deny events — Operations → Activity and Runtime log; no production blocks yet.
3. Identity smoke — OIDC dashboard login + SCIM provision/deprovision E2E when IdP is ready (SSO guide).

OpenShift / CRC

OpenShift values overlay and CRC validation checklist ship in the enterprise sandbox deploy pack (NDA). Sidecar runs non-privileged under restricted-v2 for audit/enforce v1. eBPF kernel-plane requires a separate privileged DaemonSet and SCC review — see eBPF kernel plane.

Phase 2 — Dual-control activate

1. Admin A requests enforce in Operations → Enforcement (pending activation appears in approver inbox).
2. Admin B approves in the Approver inbox — same user cannot self-approve.
3. Export committee pack from Operations → Compliance for risk committee review.
4. Air-gap tenants — download signed activation artifact; apply via Helm/GitOps.
5. Apply enforce profile:

helm upgrade sidecar blekline-ingress \
  -n blekline \
  -f deploy/k8s/sidecar/values-production.yaml \
  -f deploy/k8s/values-enforce-profile.yaml

1. Probe — confirm live block/mask events with enforce metadata (not would-deny only).

See Kubernetes deployment for topology A (standalone ClusterIP) vs B (mutating webhook inject).

Phase 3 — Evidence and operate

1. Export posture, enforcement stats, and honesty box from Operations → Compliance.
2. Map findings to your control framework (DORA, GDPR, internal risk language) — Blekline provides evidence enablement, not certification.
3. Trust Vault key ceremony — customer generates BLEKLINE_VAULT_MASTER_KEY in HSM or sealed secret store; mount via External Secrets / AKV — never commit to Git.
4. PVC backup — snapshot Trust Vault PVC before sidecar upgrades (Recreate strategy = brief outage).

Related guides

Next steps: Enterprise in-VPC · Cursor verification · Compliance evidence · Open workspace