# Reference architecture

Blekline **complements** Kong, Okta, and CASB — it does not replace them. Insert NHIM runtime enforcement at **Layer 4** (agent execution hop).

## Stack layers

```text
L5  Agent consumers     Cursor · Claude Code · SDK agents · K8s agent pods
         │ prompts · tools/call · model API
L4  Blekline            mask · enforce · Trust Vault · Lineage · audit
         │
L3  Gateways            Kong AI Gateway · LLM routers · MCP OAuth
         │
L2  Human IAM           Okta · Azure AD · Veza
         │
L1  Network / CASB      Zscaler · Nightfall · SaaS DLP
```

## Production target state (K8s)

```text
┌──────────── Customer VPC (K8s) ────────────┐
│  Agent pods (LangGraph, CrewAI, MCP workers) │
│         │ mandatory hop (NetworkPolicy)      │
│         ▼                                    │
│  ┌──────────────────────────────────────┐  │
│  │ Blekline sidecar (:8787, cluster-only)│  │
│  │ · Auto-Route SDK env (Tier 1)         │  │
│  │ · Trust Vault + Lineage (NHIM)        │  │
│  └──────────────┬───────────────────────┘  │
└─────────────────┼──────────────────────────┘
                  │ policy sync (optional TLS)
                  ▼
┌──────── Blekline control plane (EEA-first) ─┐
│ Workspace policy · Activity · RBAC · SIEM    │
└─────────────────────────────────────────────┘
                  │
    ┌─────────────┴─────────────┐
    ▼                           ▼
Kong (edge MCP OAuth)      Model APIs · tools
Okta (human SSO)           Internal APIs
```

## Role split

| Product | Owns | Does not own |
|---------|------|--------------|
| **Kong** | MCP OAuth, tool ACLs, rate limits, API routes | Tool-arg mask, session lineage, Trust Vault |
| **Okta** | Human identity, SSO, entitlements | Non-human agent runtime behavior |
| **Blekline** | MCP/SDK enforce, mask, lineage, metadata audit | Human IAM, network CASB, sandbox isolation |

## Kong + Blekline wiring

1. Kong terminates MCP OAuth and route ACLs at the **edge**.
2. Agent pods in K8s use **Auto-Route** or MCP proxy so tool/model traffic hits Blekline sidecar first.
3. Activity exports metadata-only decisions to SIEM — no prompt hoarding.

**Talk track:** *"Kong secures API routes. Blekline secures agent execution state. Regulated teams need both."*

## Auto-Route tiers

## Auto-Route mode (three enforcement tiers)

When the mutating admission webhook injects `blekline-sidecar`, it also rewrites **SDK env vars** on agent containers so OpenAI / Anthropic clients route through `http://127.0.0.1:8787` automatically.

| Tier | Mechanism | Code change? |
|------|-----------|--------------|
| **1 — Auto-Route** | Webhook env inject → sidecar masks LLM ingress/egress | **No** (OpenAI/Anthropic SDK) |
| **1b — iptables Auto-Route** | Init container redirects HTTPS without env vars | **No** (Phase 2 — annotate `blekline.com/auto-route: iptables`) |
| **2 — Mandatory hop** | NetworkPolicy → agent egress only via sidecar | No (network) |
| **3 — Tool enforce** | `POST /v1/enforce-tool-call` or `@blekline/mcp-proxy` | Yes* (MCP tool argument policy) |

\* Tier 3 is required for **MCP tool argument policy** (ASI02). Auto-Route covers model API paths only.

### Injected env vars (Tier 1)

| Env var | Value |
|---------|-------|
| `BLEKLINE_AUTO_ROUTE` | `true` |
| `BLEKLINE_SIDECAR_URL` | `http://127.0.0.1:8787` |
| `OPENAI_BASE_URL` | `http://127.0.0.1:8787/v1` |
| `OPENAI_API_BASE` | `http://127.0.0.1:8787/v1` |
| `ANTHROPIC_BASE_URL` | `http://127.0.0.1:8787` |

**Opt-out per pod:** `blekline.com/auto-route: disabled`

### Roadmap dataplane (not default shipped)

- **iptables init redirect** — transparent HTTPS redirect without env vars (Tier 1b, Phase 2)
- **eBPF / Cilium** — optional dataplane integration for platform teams (Phase 3)

See enterprise sandbox `AUTO_ROUTE.md` for operator install paths.

## Related

- [Kubernetes deployment](/docs/enterprise/k8s-deployment)
- [Shadow MCP detection](/docs/enterprise/shadow-mcp-detection)
- [Trust boundaries](/docs/security/trust-boundaries)