# NHIM overview

Blekline **NHIM + AI Runtime Enforcement** governs autonomous agents at the execution boundary: what tools may run, what secrets the model sees, and whether session lineage permits destructive action.

## Hub — start here

| Resource | Link |
|----------|------|
| **Runtime Simulator** | [/docs/playground/runtime-enforcement](/docs/playground/runtime-enforcement) — interactive 3-panel demo |
| **Definitions** | [/docs/definitions](/docs/definitions) — NHIM glossary (A–Z) |
| **Threat model** | [/docs/security/threat-model](/docs/security/threat-model) |
| **Procurement pack** | [/docs/enterprise/procurement-pack](/docs/enterprise/procurement-pack) |
| **K8s deployment** | [/docs/enterprise/k8s-deployment](/docs/enterprise/k8s-deployment) — Helm + auto-inject |

## Architecture

```mermaid
flowchart LR
  Agent[L5 Agent] --> L4[Blekline L4]
  L4 --> MCP[MCP / Tools]
  L4 --> Models[Model APIs]
  L4 --> Vault[Trust Vault VPC]
```

## Wedge

Stateful execution memory + lineage at the agent hop — not human IAM, not static entitlements, not stateless routing.

## Components

| Component | Status | Description |
|-----------|--------|-------------|
| Open-core MCP/SDK | **Shipped** | Mask, enforce, audit via `@blekline/mcp-server` |
| Ingress sidecar | **Shipped** | VPC proxy with auth, body limits, policy SSE |
| Trust Vault | **Shipped v1** | Cross-turn tokenization; hydrate stays in-cluster |
| Lineage Firewall | **Shipped v1** | Block destructive tools when lineage contaminated |
| K8s Helm sidecar | **Shipped** | `packages/ingress-proxy/helm` — image `ghcr.io/blekline/sidecar` |
| K8s mutating webhook (auto-inject) | **Shipped** | `deploy/k8s/admission` — opt-in annotation |
| SPIFFE hydrate binding | **Shipped v1** | Allowlist + entry-bound `spiffeId`; `x-spiffe-id` header |
| SPIRE Workload API JWT verify | **Roadmap** | Full cryptographic SVID verification |

## Local trial

```bash
bash scripts/local-sidecar-env.sh
```

See [Trust Vault sidecar](/docs/enterprise/trust-vault-sidecar), [Lineage enforcement](/docs/enterprise/lineage-enforcement), and [Kubernetes deployment](/docs/enterprise/k8s-deployment).

## What we do not claim

- SOC 2 Type II certified (roadmap)
- Full CASB / network DLP replacement
- All NHIM source open — runtime engine remains private; OSS is the adoption wedge