Blekline NHIM + AI Runtime Enforcement governs autonomous agents at the execution boundary: what tools may run, what secrets the model sees, and whether session lineage permits destructive action.
Hub — start here
| Resource | Link |
|---|---|
| Runtime Simulator | /docs/playground/runtime-enforcement — interactive 3-panel demo |
| Definitions | /docs/definitions — NHIM glossary (A–Z) |
| Threat model | /docs/security/threat-model |
| Procurement pack | /docs/enterprise/procurement-pack |
| K8s deployment | /docs/enterprise/k8s-deployment — Helm + auto-inject |
| NHIM Audit CLI | /docs/tools/nhim-audit — free static K8s agent-hop scan |
Architecture
flowchart LR
Agent[L5 Agent] --> L4[Blekline L4]
L4 --> MCP[MCP / Tools]
L4 --> Models[Model APIs]
L4 --> Vault[Trust Vault VPC]
Wedge
Stateful execution memory + lineage at the agent hop — not human IAM, not static entitlements, not stateless routing.
Components
| Component | Status | Description |
|---|---|---|
| Open-core MCP/SDK | Shipped | Mask, enforce, audit via @blekline/mcp-server |
| NHIM sidecar (Docker / K8s) | Shipped | Image ghcr.io/blekline/sidecar — auth, Trust Vault, Lineage, policy SSE |
| Trust Vault | Shipped v1 | Cross-turn tokenization; hydrate stays in-cluster |
| Lineage Firewall | Shipped v1 | Block destructive tools when lineage contaminated |
| Reference sidecar + Helm (OSS) | Shipped | blekline-oss/packages/ingress-proxy — contracts enforcement; not the NHIM image |
| K8s mutating webhook (auto-inject) | Shipped | deploy/k8s/admission — opt-in annotation |
| SPIFFE hydrate binding | Shipped v1 | Allowlist + entry-bound spiffeId; x-spiffe-id header |
| SPIRE JWT-SVID verify | Shipped v1 | Cryptographic verify on hydrate path (enterprise eval / sandbox) |
Local trial
bash scripts/local-sidecar-env.sh
See [Trust Vault sidecar](/docs/enterprise/trust-vault-sidecar), Lineage enforcement, and Kubernetes deployment.
What we do not claim
- SOC 2 Type II certified (roadmap)
- Full CASB / network DLP replacement
- All NHIM runtime source open — runtime engine remains private; open-core MCP, audit CLI, and reference sidecar ship on GitHub