When does User Agent or IP sniff become cloaking?

What is the line between what is White hat / Black hat with regards to IP detection / redirection / spider detection

Is there any documentation that any of you have from the Search Engines on this issue?

The "line", if you will, is drawn when you specifically show different content to the search engine bots than you do to the human visitors. If the content is different then you're cloaking--and that's frowned upon by the search engines. You can specifically find information in Google's Webmaster Guidelines regarding cloaking.

Lots of very big sites out there do useragent cloaking, but in a fairly white hat sense, it's not a real problem as long as you are not actually serving up different content, just removing unnecessary elements for the search bots. Many of the big news sites out there do that, webmasterworld does it, but it's very subtle.

Now however if you are talking about actually cloaking, serving up different content to spiders, or keyword enriched content etc, that's a problem, and should most definitely not be engaged in on a primary domain, a non-disposable domain that is, it's a very high risk activity, especially if you have little or no idea of how to do it or even what it is.