Egress governance controls what agents expose after model calls and before third-party APIs — complementary to ingress controls on prompts and tool args.
Shipped today
| Capability | Surface |
|---|---|
| Response mask | /api/ingress/v1/chat/completions, /api/ingress/v1/messages — assistant content redacted on return path |
| SDK outbound mask | Python/TS mask() before API posts |
| Audit metadata | Activity log records entitiesMasked; no raw content by default |
Enterprise program (not full DLP)
- Browser paste/download block enforcement (extension telemetry only today)
- Cross-SaaS Workspace DLP
- Endpoint CASB sensors
Do not expect Blekline to replace network DLP. It governs agent runtime surfaces at the execution boundary.
Code pattern (Python agent)
Mask before outbound HTTP from your agent runtime:
from blekline import BleklineClient
client = BleklineClient(token="blw_...")
masked = client.mask(text=payload)
# post masked.masked_text to third-party API
Ingress proxy response path
When using the OpenAI-compatible ingress proxy, Blekline masks user/system messages on the request and assistant content on the response before your agent receives the payload.
Next steps: [Runtime enforcement](/docs/introduction/interaction-governance) · [NHIM overview](/docs/introduction/nhim) · Trust boundaries