Get started

Playground

Runtime Enforcement Simulator

Interactive NHIM simulator — NHI attestation, YAML policy, tool payloads, and SIEM export.

View as Markdown
Real

Contracts enforce, YAML policy, egress rules — same code paths as MCP / CI, running in your browser.

Demo

Lineage contamination uses a simplified graph — mirrors Lineage Firewall semantics; production runs in the sidecar with session TTL.

Simulated

SPIFFE / IAM attestation is narrative only — no SPIRE or STS call from the docs page. Verify workload identity on fleet eval or K8s deployment.

01

Identity & policy

NHI selector + Trust Vault policy YAML

spiffe://blekline.internal/ns/prod/sa/data-agent-v2

Policy definitionYAML
02

Threat / payload

Edit the tool-call JSON or pick a scenario above.
Tool call payloadJSON

Run enforcement

Policy and payload are evaluated locally with Blekline contracts.

03

Runtime interceptor

Lineage Firewall + Trust Vault trace stream
Idle
ATTESTATION
EVALUATION
POLICY
LINEAGE
ENFORCEMENT

Awaiting execution — enforce a scenario to stream traces.

Trace output appears here after execution.

What is real vs demo vs simulated

The playground runs in your browser — no sidecar, no SPIRE socket, no cluster NetworkPolicy. We label trace lines Real, Demo, or Simulated so diligence stays honest.

LabelWhat runsWhy
Real@blekline/contracts enforce, YAML policy parse, payload keyword deny, egress allowlistSame libraries as MCP server and CI — provable in OSS
DemoLineage contamination blockUses a simplified session flag + destructive-tool list that mirrors Lineage Firewall semantics. Production graph + mandatory hop live in the ingress sidecar (LineageGraph in @blekline/runtime-engine)
SimulatedSPIFFE / IAM / OAuth M2M attestationNarrative trace only — the docs page cannot call SPIRE or AWS STS. Workload identity verification ships on fleet / K8s eval (JWT-SVID verify, SPIRE in Helm values)

Why not fake everything? Mask, deny, and egress enforcement are the wedge — they must be real so a security reviewer can diff against npm packages. Attestation and full lineage graph need infrastructure; we simulate/demo those rather than imply crypto that did not run.

Why lineage is Demo, not Simulated: The playground does evaluate contamination + destructive tools — it is simplified logic, not a scripted PASS/FAIL string. On cluster, the sidecar maintains an intent graph with TTL and /v1/lineage/contaminate.

Scenarios

  1. Prompt injection → DROP TABLE — contaminated session + destructive SQL (lineage Demo + policy Real)
  2. Egress exfiltration — disallowed external host (Real egress rule)
  3. Compliant RAG query — allowlisted destination (Real allow path)