# Runtime Enforcement Simulator


## What is real vs simulated

| Step | Source |
|------|--------|
| Secret scan, contracts enforce | **Real** — `@blekline/contracts` |
| YAML payload / egress rules | **Real** — playground policy evaluator |
| Lineage contamination block | **Demo** — mirrors Lineage Firewall |
| SPIFFE / IAM attestation | **Simulated** — NHIM roadmap |

See [NHIM overview](/docs/introduction/nhim) for the Shipped/Roadmap table.

## Scenarios

1. **Prompt injection → DROP TABLE** — contaminated session + destructive SQL
2. **Egress exfiltration** — disallowed external host
3. **Compliant RAG query** — allowlisted destination for retrieval tools

## Related terms

- [Non-Human Identity (NHI)](/docs/definitions/non-human-identity)
- [Lineage Firewall](/docs/definitions/lineage-firewall)
- [Trust Vault](/docs/definitions/trust-vault)