Built for the assumption that agents will misbehave.
Agents are eager, prompts are hostile. TapPass holds every agent at least privilege, redacts data before it moves, and stops the risky calls for a person — so a bad instruction can’t become a bad outcome.
“Refund €8,200 to Maria Lambert,
IBAN BE68 5390 0754 7034,
ref +32 470 12 34 56”
Six controls, on every call.
Least privilege by default
Every agent gets the tools its job needs — nothing standing, nothing implicit.
Redaction in transit
PII and secrets are redacted in the request path, before a model or tool ever sees them.
Encrypted key vault
You keep your own model keys (BYOK). They live encrypted, never on a user’s device.
Human-in-the-loop
The risky calls stop for a person — approve in Slack, email or a strong-auth tap with itsme.
Tamper-evident audit
Every allow, hold and block is recorded and exportable. Evidence is a query, not a project.
Prompt-injection containment
A hostile instruction still can’t exceed the agent’s remit — policy holds even when the prompt turns.
TapPass does not hold SOC 2 or ISO 27001, and no feature guarantees a compliance outcome. What it does is give your security and compliance teams the controls and the evidence — least privilege, redaction, human approval and a queryable record — that make your own attestations defensible.
Keep reading
AI Agent Security Is Not LLM Security
Agents call tools, chain actions, and make decisions.
Zero Trust for AI Agents: What Least Privilege Actually Means
Least privilege for humans is well understood.
Prompt Injection Is Not an AI Problem. It's an Agent Problem.
Most content about prompt injection focuses on making the model say bad things.