Pattern guide — wire via
@blekline/clientor MCP proxy. No dedicated package in this repo.
| Layer | Product | Role |
|---|---|---|
| L4 | Blekline | Mask prompts, govern tool calls, audit |
| L2 | Azure OpenAI | Model API / routing |
Wiring
- Point SDK
base_urlathttps://app.blekline.com/api/ingress/v1 - Set server
OPENAI_API_BASEto:https://{your-resource}.openai.azure.com/openai/deployments/{deployment} - Provide upstream API key or IAM credentials on the sidecar (BYOK)
export BLEKLINE_WORKSPACE_TOKEN=blw_...
export OPENAI_API_BASE=https://{your-resource}.openai.azure.com/openai/deployments/{deployment}
Flow: Agent/SDK → L4 Blekline ingress → L2 Azure OpenAI → model response.
Enterprise
- Auth / BYOK — You own upstream API keys or IAM roles; Blekline never stores them (sidecar env only).
- Data residency — Align Blekline mask region with upstream; see Multi-region ingress.
- Private deploy — Run ingress sidecar in your VPC; see Deployment.
- EU AI Act — Audit trail + human oversight; see EU AI Act mapping.
- Trust — Metadata-only audit by default; see Trust boundaries.
See Azure OpenAI documentation.
Next steps: Model providers hub · Ingress proxy · Deployment · Open workspace