This is the enterprise golden path for evaluating Blekline runtime enforcement. Pick a track based on your environment and compliance scope.
Choose your track
| Track | Audience | Time | Outcome |
|---|---|---|---|
| 01 — MCP | IDE / agent client teams | ~30 min | Mask and enforce tools in Cursor or Claude Code |
| 02 — Docker sidecar | Platform eng, VPC eval | ~1 h | Trust Vault + lineage on :8787 in Docker |
| 03 — Kubernetes fleet | CISO, SRE, regulated prod | ~2 h | Mandatory-hop sidecar + optional admission webhook |
Most enterprise buyers start with Track 03 after a static [NHIM audit](/docs/get-started/nhim-audit-quickstart).
Track 01 — MCP client eval
- Create a workspace API key with
mask:writeandevents:writescopes. - Install
@blekline/mcp-serverin Cursor or Claude Code. - Run the live MCP test in Operations → MCP and confirm mask/enforce tools respond.
See also: Quick Start for CLI smoke and integration matrix.
Track 02 — Docker sidecar
Platform teams validate sidecar auth, Trust Vault, and lineage without a cluster.
- Optional: run [NHIM audit quickstart](/docs/get-started/nhim-audit-quickstart) against staging.
- Pull
ghcr.io/blekline/sidecar:0.2.0-nhimand configure secrets. - Start the compose stack and verify
/health(401 without auth, 200 with token). - Trigger the first enforce event in Operations → Activity.
Full steps: Docker sidecar.
Track 03 — Kubernetes fleet
Production-oriented eval with mandatory-hop NetworkPolicy and optional mutating admission.
- Run
npx @blekline/nhim-audit auditand upload JSON to Operations → Posture. - Create eval namespace + sidecar secrets.
- Helm install
blekline-ingressand apply mandatory-hop NetworkPolicy. - Optional: install admission webhook for auto-inject on annotated pods.
- Request probe token if CRITICAL gaps remain; verify runtime enforce.
Full steps: Kubernetes fleet · NHIM verification.
CI gates
Block merges when agent infrastructure drifts from NHIM posture:
- CI NHIM gate — merge-blocking cluster audit
- CI/CD — integration config and MCP smoke
What to read first
- Runtime enforcement — product model
- NHIM overview — mandatory hop and ASI alignment
- Architecture — control plane vs sidecar
- Procurement pack — DPA, cyber brief, eval deck
Get sandbox access
Enterprise sandbox packs (Track 02/03 Helm, checklists, probe tokens) ship on grant approval.
Contact enterprise@blekline.com with your nhim-audit.json attached, or book via blekline.com/enterprise#contact.
Try the simulator: Runtime Enforcement Simulator · Definitions · Open workspace