Blekline NHIM + AI Runtime Enforcement governs autonomous agents at the execution boundary: what tools may run, what secrets the model sees, and whether session lineage permits destructive action.
Hub — start here
| Resource | Link |
|---|---|
| Runtime Simulator | /docs/playground/runtime-enforcement — interactive 3-panel demo |
| Definitions | /docs/definitions — NHIM glossary (A–Z) |
| Threat model | /docs/security/threat-model |
| Procurement pack | /docs/enterprise/procurement-pack |
| K8s deployment | /docs/enterprise/k8s-deployment — Helm + auto-inject |
Architecture
flowchart LR
Agent[L5 Agent] --> L4[Blekline L4]
L4 --> MCP[MCP / Tools]
L4 --> Models[Model APIs]
L4 --> Vault[Trust Vault VPC]
Wedge
Stateful execution memory + lineage at the agent hop — not human IAM, not static entitlements, not stateless routing.
Components
| Component | Status | Description |
|---|---|---|
| Open-core MCP/SDK | Shipped | Mask, enforce, audit via @blekline/mcp-server |
| Ingress sidecar | Shipped | VPC proxy with auth, body limits, policy SSE |
| Trust Vault | Shipped v1 | Cross-turn tokenization; hydrate stays in-cluster |
| Lineage Firewall | Shipped v1 | Block destructive tools when lineage contaminated |
| K8s Helm sidecar | Shipped | packages/ingress-proxy/helm — image ghcr.io/blekline/sidecar |
| K8s mutating webhook (auto-inject) | Shipped | deploy/k8s/admission — opt-in annotation |
| SPIFFE hydrate binding | Shipped v1 | Allowlist + entry-bound spiffeId; x-spiffe-id header |
| SPIRE Workload API JWT verify | Roadmap | Full cryptographic SVID verification |
Local trial
bash scripts/local-sidecar-env.sh
See [Trust Vault sidecar](/docs/enterprise/trust-vault-sidecar), Lineage enforcement, and Kubernetes deployment.
What we do not claim
- SOC 2 Type II certified (roadmap)
- Full CASB / network DLP replacement
- All NHIM source open — runtime engine remains private; OSS is the adoption wedge