# Runtime enforcement

Blekline is **Non-Human Identity & Runtime Enforcement** infrastructure: a control plane for what autonomous agents send, execute, and expose at the execution boundary.

See the [NHIM overview](/docs/introduction/nhim) for the full hub — simulator, definitions, threat model, and Shipped/Roadmap table.

## Three boundaries

| Boundary | What it governs | Primary surfaces |
|----------|-----------------|------------------|
| **Ingress** | Prompts and tool arguments before models/tools | MCP proxy, SDK `/api/mask`, `/api/mcp/enforce-tool-call` |
| **Egress** | Model outputs and outbound API payloads | Ingress proxy response mask, SDK hooks |
| **Audit** | Evidence for security review | Activity log, `/api/audit`, SIEM forward |

## Where to start

- Developers: [MCP proxy](/docs/mcp/proxy) · [Python SDK](/docs/sdk/python) · [Runtime Simulator](/docs/playground/runtime-enforcement)
- Security: [Trust boundaries](/docs/security/trust-boundaries) · [Why ingress](/docs/introduction/why-ingress)
- Egress detail: [Egress governance](/docs/introduction/egress-governance)
- Glossary: [Definitions](/docs/definitions)

## What this is not

Not a browser extension product, not full CASB/DLP, not a model routing marketplace. See [Architecture](/docs/introduction/architecture).

---

**Next steps:** [Quick start](/docs/introduction/quick-start) · [NHIM overview](/docs/introduction/nhim) · [EU AI Act](/docs/introduction/eu-ai-act)