What is TapPass

TapPass is the authority layer for agentic AI. It sits between the apps, assistants, and agents your teams use and the models, tools, and data they reach, and it decides, enforces, and records what each one is allowed to do.

You keep using the tools you already have. You change one thing: where they send their calls. From that point on, every request runs through your rules and lands in one audit trail.

AI agents now call models, run tools, touch customer data, and take actions, often with no guardrails and no record. That leaves three gaps:

• No control. Any agent can use any model, call any tool, and send any data wherever it likes.
• No visibility. Nobody can say later what an agent did, with which data, and why.
• No proof. When security, legal, or an auditor asks, there is nothing to show.

TapPass closes all three without asking you to rewrite your apps.

• Decides what each agent may do. Which models, which tools, which data, which actions.
• Enforces it in real time. Blocks or allows each call, masks PII and secrets, and holds provider keys so your apps never see them.
• Asks a human when it matters. Risky actions can require approval before they run.
• Records everything. Every decision lands in a tamper-evident audit trail.
• Proves compliance. Export evidence for GDPR, the EU AI Act, and SOC 2 straight from that trail.

TapPass gives your agents a single place to reach everything, and governs it all on the way through. There are two planes.

TapPass has a native model router. Your agent points at one base URL with one key, and TapPass routes each call to the right provider: OpenAI, Anthropic, Azure, Bedrock, Gemini, or a model you host yourself. You switch or add models in TapPass, not in every app, and every call is governed and recorded on the way.

TapPass is a virtual MCP (Model Context Protocol, the open standard agents use to call tools). Instead of wiring each agent to each tool server, your agent connects to one TapPass MCP endpoint that fronts all of your MCP servers (GitHub, Slack, Jira, internal servers). Every tool call across every server runs through the same policy and the same audit trail. One connection, every tool, governed.

A fair question is “we already use Microsoft” (or our cloud provider, or a guardrail library). Here is the honest difference.

• Microsoft and other cloud suites secure their own cloud and their own assistant. They govern data at rest and protect first-party surfaces well. TapPass governs agent actions at runtime, across every model and every tool, including the ones that live outside that cloud. Agents do not stay inside one vendor’s walls, so the authority layer cannot either.
• Guardrail libraries inspect text at the edge of the model. That is advice on the prompt and the response. TapPass enforces in the request path, and it governs tool calls, not only prompts. The risk is in what the agent does, not only in what it says.
• API gateways route and secure traffic. TapPass understands agent intent and tool semantics, so a decision is about whether this action is appropriate right now, not just whether an endpoint is reachable.
• Observability tools show you what the model did. TapPass can stop it before it happens and hand you the exact rule that stopped it.
• EU hosted and model and cloud agnostic. Not bundled with one provider, and built for European governance requirements.

In short: your cloud suite is a good floor. TapPass is the authority layer that spans every model and tool your agents touch, decides before the action, and keeps the evidence.

Governance is intention based: TapPass governs what you connect to it. A tool that never routes through TapPass is not governed by TapPass. For most teams that is the point, you choose the governed path and everything flows through it.

When you need to guarantee that the governed path is the only path, for example to stop an agent reaching a model or supplier you did not approve, you add a confinement layer beneath TapPass:

• Client-side enforcement. Lock the tool’s configuration so it can only reach TapPass, for example a managed Claude Desktop rolled out through MDM with read-only settings.
• Secure sandboxes. Run the agent inside a sandbox that constrains what it can reach at all. TapPass sits on top of such a sandbox and will sync to NVIDIA OpenShell sandboxes (coming soon), so confinement makes the TapPass request path the only path, and TapPass decides whether each permitted action is right.

See Connect your harness for the per-tool coverage detail, and Sandboxes and enforcement for how confinement makes the governed path the only path, end to end.

Almost anything that talks to a model. Claude Desktop, Claude Code, Cursor, GitHub Copilot, the Microsoft Copilot family, n8n and other low-code tools, and any app built on the OpenAI or Anthropic SDKs.

Connect your harness has a page for each one, plus a coverage table showing exactly what TapPass can govern (the model call, the tool calls, or both) for every tool.

• Platform and security teams set the policy, watch the footprint, and own the audit trail and compliance evidence.
• Developers keep their existing apps and frameworks and get governance by changing a base URL, with a Python SDK and HTTP API when they want more control.

1. Quick Start sign up, connect your first model and MCP, and govern your first call.
2. Connect your harness point the tools your team already uses at TapPass.
3. What you can do the core flows: govern from a sentence, the verdict API, watch mode, and more.
4. How TapPass works the decision model, in plain terms.