Blekline complements Kong, Okta, and CASB — it does not replace them. Insert NHIM runtime enforcement at Layer 4 (agent execution hop).
Stack layers
L5 Agent consumers Cursor · Claude Code · SDK agents · K8s agent pods
│ prompts · tools/call · model API
L4 Blekline mask · enforce · Trust Vault · Lineage · audit
│
L3 Gateways Kong AI Gateway · LLM routers · MCP OAuth
│
L2 Human IAM Okta · Azure AD · Veza
│
L1 Network / CASB Zscaler · Nightfall · SaaS DLP
Production target state (K8s)
┌──────────── Customer VPC (K8s) ────────────┐
│ Agent pods (LangGraph, CrewAI, MCP workers) │
│ │ mandatory hop (NetworkPolicy) │
│ ▼ │
│ ┌──────────────────────────────────────┐ │
│ │ Blekline sidecar (:8787, cluster-only)│ │
│ │ · Auto-Route SDK env (Tier 1) │ │
│ │ · Trust Vault + Lineage (NHIM) │ │
│ └──────────────┬───────────────────────┘ │
└─────────────────┼──────────────────────────┘
│ policy sync (optional TLS)
▼
┌──────── Blekline control plane (EEA-first) ─┐
│ Workspace policy · Activity · RBAC · SIEM │
└─────────────────────────────────────────────┘
│
┌─────────────┴─────────────┐
▼ ▼
Kong (edge MCP OAuth) Model APIs · tools
Okta (human SSO) Internal APIs
Role split
| Product | Owns | Does not own |
|---|---|---|
| Kong | MCP OAuth, tool ACLs, rate limits, API routes | Tool-arg mask, session lineage, Trust Vault |
| Okta | Human identity, SSO, entitlements | Non-human agent runtime behavior |
| Blekline | MCP/SDK enforce, mask, lineage, metadata audit | Human IAM, network CASB, sandbox isolation |
Kong + Blekline wiring
- Kong terminates MCP OAuth and route ACLs at the edge.
- Agent pods in K8s use Auto-Route or MCP proxy so tool/model traffic hits Blekline sidecar first.
- Activity exports metadata-only decisions to SIEM — no prompt hoarding.
Talk track: "Kong secures API routes. Blekline secures agent execution state. Regulated teams need both."
Auto-Route tiers
Auto-Route mode (three enforcement tiers)
When the mutating admission webhook injects blekline-sidecar, it also rewrites SDK env vars on agent containers so OpenAI / Anthropic clients route through http://127.0.0.1:8787 automatically.
| Tier | Mechanism | Code change? |
|---|---|---|
| 1 — Auto-Route | Webhook env inject → sidecar masks LLM ingress/egress | No (OpenAI/Anthropic SDK) |
| 1b — iptables Auto-Route | Init container redirects HTTPS without env vars | No (Phase 2 — annotate blekline.com/auto-route: iptables) |
| 2 — Mandatory hop | NetworkPolicy → agent egress only via sidecar | No (network) |
| 3 — Tool enforce | POST /v1/enforce-tool-call or @blekline/mcp-proxy | Yes* (MCP tool argument policy) |
* Tier 3 is required for MCP tool argument policy (ASI02). Auto-Route covers model API paths only.
Injected env vars (Tier 1)
| Env var | Value |
|---|---|
BLEKLINE_AUTO_ROUTE | true |
BLEKLINE_SIDECAR_URL | http://127.0.0.1:8787 |
OPENAI_BASE_URL | http://127.0.0.1:8787/v1 |
OPENAI_API_BASE | http://127.0.0.1:8787/v1 |
ANTHROPIC_BASE_URL | http://127.0.0.1:8787 |
Opt-out per pod: blekline.com/auto-route: disabled
Roadmap dataplane (not default shipped)
- iptables init redirect — transparent HTTPS redirect without env vars (Tier 1b, Phase 2)
- eBPF / Cilium — optional dataplane integration for platform teams (Phase 3)
See enterprise sandbox AUTO_ROUTE.md for operator install paths.