Blekline Runtime Simulator (embed)

Real

Contracts enforce, YAML policy, egress rules — same code paths as MCP / CI, running in your browser.

Demo

Lineage contamination uses a simplified graph — mirrors Lineage Firewall semantics; production runs in the sidecar with session TTL.

Simulated

SPIFFE / IAM attestation is narrative only — no SPIRE or STS call from the docs page. Verify workload identity on fleet eval or K8s deployment.

NHI attestation

spiffe://blekline.internal/ns/prod/sa/data-agent-v2

Policy definitionYAML

version: v1alpha1
target_nhi: "spiffe://blekline.internal/ns/prod/*"
rules:
  - name: block_destructive_database_mutations
    action: DENY
    match:
      payload_contains: ["DROP TABLE", "DELETE FROM", "ALTER TABLE"]
  - name: restrict_egress_domains
    action: ENFORCE_EGRESS_ALLOWLIST
    allowed_hosts: ["api.stripe.com", "vector-db.internal"]
  - name: max_execution_depth
    action: THROTTLE
    max_tool_calls_per_min: 10

Tool call payloadJSON

{
  "agent_id": "agent-89b2",
  "session_id": "sess-inject-01",
  "requested_tool": "postgres_query_executor",
  "params": {
    "sql": "SELECT * FROM users; DROP TABLE audits;"
  }
}

Run enforcement

Policy and payload are evaluated locally with Blekline contracts.

ATTESTATION

EVALUATION

POLICY

LINEAGE

ENFORCEMENT

Awaiting execution — enforce a scenario to stream traces.

Trace output appears here after execution.