AI security for enterprises that cannot get it wrong. At the agent layer, at runtime.
Your agents make thousands of decisions an hour. TapPass intercepts every one before it runs, blocks threats, enforces your rules and writes the evidence regulators expect.
✓Fail-closed by default
Model safety judges what an AI says. Agent security judges what it does.
A prompt injection does not need harmful text. It needs the agent to take an unauthorised action.
Most AI security tools focus on the model: content filters, prompt hardening, output validation. They matter, but they miss the real attack surface.
Agents are not models. They are programs that call tools, read databases, send email and chain actions across systems. The damage comes from what the agent does, not from what the model says.
Securing them takes interception at the agent layer, at runtime: a decision on every action, outside the model, before it reaches the world.
Intercept, evaluate, enforce, prove. Before the action runs.
Every prompt, tool call and model response flows through TapPass. Connecting is one configuration change in OpenAI, Anthropic, LangChain, CrewAI or any OpenAI-compatible endpoint.
Direct, indirect and multi-turn prompt injection. PII in Dutch, German, French, Spanish, Italian and Belgian contexts. Secrets, exfiltration through tools or encoded output, least privilege per tool and operation, and spend limits per agent and organisation.
Block the request with a logged reason. Redact sensitive data and let the agent continue. Hold the action for a person. Alert your SIEM, Slack or a webhook.
blockredactholdalertEvery decision becomes a tamper-evident record, SHA-256 hash-chained, with which agent, tool, data, rule and verdict, and when. The evidence the EU AI Act, GDPR, DORA and NIS2 ask for.
A person reviews twelve cases an hour. An agent processes two hundred.
When a person makes a bad call, one case is wrong. When an agent gets a rule wrong, two hundred cases are out the door before the next audit. TapPass decides as it happens, at the speed agents work.
A bad agent decision costs differently in every sector.
A loan agent drifting outside its risk parameters is stopped in time. DORA, PII protection and full audit trails.
HealthcareArticle 9 data, handled in the pipelinePatient data through a triage agent is classified and protected as it flows, not as an afterthought.
InsuranceFlagged before the payout goes outA claims agent that misclassifies injury severity is held. Solvency II and EU AI Act aligned.
GovernmentSovereign, self-hosted, air-gappedNo data leaving your infrastructure, NIS2 in mind, and air-gapped options for classified environments.
LegalPrivilege and Chinese walls, enforcedPer-matter audit trails and walls between matters for AI-assisted legal work.
SaaS and technologyTenant isolation for AI featuresMulti-tenant data isolation and customer data protection for SaaS companies shipping AI.
Most tools solve one piece. TapPass governs the action.
We also cover tool governance, PII, secrets, exfiltration and budgets.
Compare with Prompt Armor vs model monitoringStopped before, not charted afterMonitoring tracks model metrics. TapPass decides agent actions at runtime.
Compare with Arthur AI vs output validatorsActions, not just responsesValidators catch bad text. TapPass catches tool calls, data flows and decision chains.
Compare with Guardrails AI vs security API bundlesOne pipeline, one recordNo orchestrating several services: one integration point, one rulebook, one audit trail.
Compare with PangeaWe write about securing agents in production. Start here.
Why the threat model for agents is different from securing a model.
Prompt injection is an agent problemThe risk is making the agent do bad things, not say them.
Shadow AI is a governance problemTeams deploy agents without telling security. Blocking them will not work.
What to prioritise, and when.
DORA and AIDORA treats AI agents as ICT assets. Every resilience requirement applies.
EU AI Act Article 14: human oversightWhat Article 14 requires at runtime, not just on paper.
What least privilege means when the user is an autonomous system.
Designing auditable agents from day oneCompliance evidence as a by-product of normal operation.
What your AI audit trail is missingTool calls, data flows and decision chains, not just prompts.
AI security in 2026From model safety to agent governance: what CISOs need now.
Real-time monitoring for AI agentsWhy dashboards built for human speed fall short.
Securing agents in regulated industriesWhen a bad decision has a euro figure, a patient or a liability attached.
How is this different from a guardrail on the model?
A guardrail judges text. TapPass judges actions: the tool call, the data it touches and who it is for, before it runs. A prompt injection does not need harmful text; it needs an unauthorised action, and that is what TapPass stops.
How much latency does it add?
About 200 ms per decision, against a model call that typically takes seconds.
What if TapPass is unavailable?
It fails closed by default: if your rules cannot be loaded, the call is blocked. For specific integrations you can choose to fail open and log.
Which languages does PII detection cover?
Language-specific recognisers for Dutch, German, French, Spanish, Italian and Belgian contexts, on top of the usual patterns for IBANs, phone numbers and emails.
Secure what your agents do. Not only what they say.
Connect one agent and see every call TapPass would have held, stopped or routed elsewhere. Nothing is blocked while you learn.
✓ EU hosted✓ Built in Belgium✓ Your own model keys✓ Encrypted at rest and in transit✓ DPA on request