Blekline | Non-Human Identity & Runtime Enforcement

Deployment models

Model	Control plane	Ingress
SaaS	`app.blekline.com`	MCP stdio + `/api/ingress/v1/*`
Private tenant	Customer subdomain or VPC	Same API surface, customer data residency
Sidecar	Daytona / k8s pod	`packages/ingress-proxy` Docker image

SSO status

Method	Status	Notes
Google / LinkedIn OAuth	Shipped	Dashboard login via NextAuth
Enterprise OIDC (Okta, Azure AD)	Shipped	Configure IdP per steps below
SAML SP	Enterprise program	Contact sales for timeline

Enterprise workspaces integrate IdP at the dashboard layer (NextAuth-compatible OIDC).

Okta / Azure AD OIDC (dashboard)

Create an OIDC app in your IdP with redirect URI: https://app.blekline.com/api/auth/callback/oidc (adjust for your deployment).
Set env on Blekline deployment: OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET.
Map email claim to workspace membership (invite users by email before first login).
Use workspace API tokens (mask:write, events:write) for agent runtimes — separate from human SSO.

SAML roadmap

Planned SAML attributes:

email → workspace membership mapping
groups → role (owner / admin / member)
tenant_id → workspace isolation

Until SAML ships, use OIDC above or Google/LinkedIn for pilot tenants.

Agent runtimes use workspace API tokens (mask:write, events:write) — separate from human SSO. SCIM-style roster via /api/workspace/roster where enabled.

Policy push

Fleet sensors subscribe to GET /api/workspace/policy-stream (SSE). On policy events, refresh local allow/deny caches for MCP proxy and ingress sidecars.

Hardening checklist

Rotate workspace API tokens quarterly
Set MCP tool denylist for destructive tools (rm, drop_database, etc.)
Enable ingress block mode (BLEKLINE_INGRESS_BLOCK_HIGH_RISK=true)
Export audit logs to SIEM (/api/integrations/siem)
Run Cursor model matrix QA (demo/cursor/model-matrix.md)

Support

Enterprise leads: /api/enterprise/lead or sales@blekline.com.

Next steps: AI Enablement Stack · Deployment · Architecture · Open workspace · Report issue