Blekline | Non-Human Identity & Runtime Enforcement

@blekline/[nhim](/docs/definitions/nhim)-audit scans Kubernetes clusters for agent candidate workloads that may bypass MCP/runtime enforcement hops.

npx @blekline/nhim-audit audit

No Blekline account required for static audit.

Quick start

kubectl apply -f https://raw.githubusercontent.com/Blekline/blekline-oss/main/packages/nhim-audit/deploy/rbac/nhim-audit-reader.yaml
npx @blekline/nhim-audit audit --plain --json -o nhim-audit.json

Demo (fixture cluster, no kubeconfig):

npx @blekline/nhim-audit demo broken

Rule reference

ID	Severity	ASI	Summary
NHIM-001	CRITICAL	ASI02, ASI10	No sidecar on agent candidate
NHIM-002	CRITICAL	ASI10	No mandatory-hop NetworkPolicy
NHIM-003	HIGH	ASI08	Admission webhook missing
NHIM-004	HIGH	ASI08	Webhook fail-open
NHIM-005	HIGH	ASI03	Sidecar externally exposed
NHIM-006	MEDIUM	ASI02	LLM env without sidecar
NHIM-007	MEDIUM	ASI03	Sidecar auth secret missing
NHIM-008	MEDIUM	ASI10	Policy gap on agent namespace
NHIM-009	LOW	—	Helm release absent
NHIM-010	INFO	ASI08	Sidecar health unreachable (static)
NHIM-011	MEDIUM	ASI10	Shared default-allow egress
NHIM-012	INFO	—	Shared responsibility reminder

CRITICAL and HIGH static findings include (STATIC — run --probe to verify).

OWASP ASI alignment

Evidence enablement only — not OWASP, AIUC-1, or EU AI Act certification.

nhim-audit maps primarily to OWASP ASI Top 10 (agentic applications), not OWASP LLM Top 10 (model-centric risks). See Compliance evidence.

AIUC-1 and EU AI Act (context)

AIUC-1 — audit JSON supports security/accountability evidence collection in customer audits; nhim-audit is not AIUC-1 certified.
EU AI Act — exported JSON may document controls for high-risk agent deployments; legal classification remains customer and counsel.
OWASP LLM Top 10 — out of scope (prompt injection into foundation models, training data risks).

Score bands

Score	Band	Meaning
0–39	CRITICAL	Mandatory hop not enforced
40–69	AT RISK	Partial enforcement
70–89	PARTIAL	Static clean — probe recommended
90–100	HARDENED	Static aligned

JSON includes score.redTeamPhase0: pass | fail | unknown.

CI integration (merge-blocking)

Copy ci/github-actions/nhim-audit or use inline:

- uses: blekline/nhim-audit-action@v1
  with:
    kubeconfig: ${{ secrets.KUBECONFIG }}
    fail-on: high
    min-score: "75"
    output: nhim-audit.json
- uses: actions/upload-artifact@v4
  with:
    name: nhim-audit-report
    path: nhim-audit.json

Flags: --fail-on critical|high|any · --min-score <n> · --baseline <path> (fail only on new findings) · -o artifact path

SARIF 2.1:

npx @blekline/nhim-audit audit --format sarif -o nhim-audit.sarif

Exit codes: 0 pass · 1 fail / baseline regression · 2 RBAC or config · 3 cluster unreachable

Store kubeconfig in GitHub Secrets only — never commit reports with real cluster names if policy requires redaction.

Probe access {#probe-access}

--probe runs active bypass checks (PROBE-001..003) and requires BLEKLINE_EVAL_TOKEN:

Run static audit and save JSON
Email enterprise@blekline.com with [nhim](/docs/definitions/nhim)-audit.json attached, or request via Track 03 sandbox grant
Receive blw_eval_… token (30-day eval scope, probe only — not a workspace token)

BLEKLINE_EVAL_TOKEN=blw_eval_… npx @blekline/nhim-audit audit --probe --json -o nhim-audit-probed.json

Online validation (optional): set BLEKLINE_EVAL_ONLINE=1 to verify against the app validate endpoint.

Enterprise / Track 03

Use nhim-audit as Step 0 before sandbox eval. Design partners who attach nhim-audit.json receive a probe eval token in the Track 03 welcome pack. See Kubernetes deployment.

FAQ

False positives? Heuristics flag agent candidates via labels, env keys, and images. Tune with --label-selector.

Static vs probe? Static infers architectural risk from RBAC-visible config. Probe verifies egress from inside candidate pods.

RBAC denied? Apply nhim-audit-reader ClusterRole from the OSS package. For --probe, also apply nhim-audit-probe (grants pods/exec).

JSON redaction? Reports include env key names in discovery.signals[] only — never secret values or eval tokens.

Disclaimer: Evidence enablement only — not certification.