# Eval journey

This is the **enterprise golden path** for evaluating Blekline runtime enforcement. Pick a track based on your environment and compliance scope.

## Choose your track

| Track | Audience | Time | Outcome |
|-------|----------|------|---------|
| **01 — MCP** | IDE / agent client teams | ~30 min | Mask and enforce tools in Cursor or Claude Code |
| **02 — Docker sidecar** | Platform eng, VPC eval | ~1 h | Trust Vault + lineage on `:8787` in Docker |
| **03 — Kubernetes fleet** | CISO, SRE, regulated prod | ~2 h | Mandatory-hop sidecar + optional admission webhook |

Most enterprise buyers start with **Track 03** after a static [NHIM audit](/docs/get-started/nhim-audit-quickstart).

## Track 01 — MCP client eval

1. Create a workspace API key with `mask:write` and `events:write` scopes.
2. Install `@blekline/mcp-server` in [Cursor](/docs/mcp/cursor) or [Claude Code](/docs/mcp/claude-code).
3. Run the live MCP test in **Operations → MCP** and confirm mask/enforce tools respond.

See also: [Quick Start](/docs/introduction/quick-start) for CLI smoke and integration matrix.

## Track 02 — Docker sidecar

Platform teams validate sidecar auth, Trust Vault, and lineage without a cluster.

1. Optional: run [NHIM audit quickstart](/docs/get-started/nhim-audit-quickstart) against staging.
2. Pull `ghcr.io/blekline/sidecar:0.2.0-nhim` and configure secrets.
3. Start the compose stack and verify `/health` (401 without auth, 200 with token).
4. Trigger the first enforce event in **Operations → Activity**.

Full steps: [Docker sidecar](/docs/deploy/docker-sidecar).

## Track 03 — Kubernetes fleet

Production-oriented eval with mandatory-hop NetworkPolicy and optional mutating admission.

1. Run `npx @blekline/nhim-audit audit` and upload JSON to **Operations → Posture**.
2. Create eval namespace + sidecar secrets.
3. Helm install `blekline-ingress` and apply mandatory-hop NetworkPolicy.
4. Optional: install admission webhook for auto-inject on annotated pods.
5. Request probe token if CRITICAL gaps remain; verify runtime enforce.

Full steps: [Kubernetes fleet](/docs/deploy/k8s-fleet) · [NHIM verification](/docs/enterprise/nhim-verification).

## CI gates

Block merges when agent infrastructure drifts from NHIM posture:

- [CI NHIM gate](/docs/deploy/ci-nhim-gate) — merge-blocking cluster audit
- [CI/CD](/docs/sdk/ci-cd) — integration config and MCP smoke

## What to read first

- [Runtime enforcement](/docs/introduction/interaction-governance) — product model
- [NHIM overview](/docs/introduction/nhim) — mandatory hop and ASI alignment
- [Architecture](/docs/introduction/architecture) — control plane vs sidecar
- [Procurement pack](/docs/enterprise/procurement-pack) — DPA, cyber brief, eval deck

## Get sandbox access

Enterprise sandbox packs (Track 02/03 Helm, checklists, probe tokens) ship on grant approval.

Contact **enterprise@blekline.com** with your `nhim-audit.json` attached, or book via [blekline.com/enterprise#contact](https://blekline.com/enterprise#contact).

---

**Try the simulator:** [Runtime Enforcement Simulator](/docs/playground/runtime-enforcement) · [Definitions](/docs/definitions) · [Open workspace](https://app.blekline.com)