Use cases · IT operations

Agents in IT ops. Without the 3am incident.

Give agents deploys, incidents and infrastructure. The change window, the secrets and the blast radius stay yours. TapPass holds what needs a person and records what happened.

✓No credit card needed

Ops copilot · liveVandaele Logistics · production
09:12allowRoll out invoice-parser to staging
09:41holdDeploy to prod-eu-west · outside the change window
09:44blockDrop table invoices · production database
10:02allowRestart the worker pool
10:05redactPaste of .env · secrets removed, sent on
Held for on-call RCRuben Claes · on call this week Deploy invoice-parser v2.4 to prod-eu-west Rule OPS-2 · production deploys outside Tue to Thu, 09:00 to 16:00, need a person
DenyApprove · Touch ID
01How it is governed

Ship fast. Break nothing.

One eager agent can deploy outside the window, rotate the wrong secret or delete a resource. Not out of malice. Because nothing stopped it.

Change-window rulesDeploys outside the window wait for the person on call. Every time, automatically.holdon-call approver
Secrets stay secretKeys and tokens are redacted before a model sees them, and never kept on the record.redactionnever stored
A small blast radiusEach agent gets the tools its job needs. Delete and drop are not among them unless you say so.least privilegevirtual servers
Coding agents includedClaude Code through hooks, Cursor and other clients through MCP. Every prompt and tool call meets the same rules.hooksMCP
Every change on the recordWho, or which agent, changed what, for whom, streamed to your SIEM as OpenTelemetry.SplunkSentinelElastic
Watch before you enforceStart in watching mode on real traffic. Switch a rule on when you trust it.watchingreplay
02Coding agents

Claude Code, governed. Nothing to install.

Add the TapPass hooks to your Claude Code settings. Every prompt and every tool call is checked before it runs, and why the agent stopped lands on the record.

.claude/settings.json
{
  "hooks": {
    "UserPromptSubmit": [ … TapPass check … ],
    "PreToolUse":       [ … TapPass check … ],
    "PostToolUse":      [ … record only … ],
    "Stop":             [ … record only … ]
  }
}
The full block is copied from TapPass when you connect Claude Code. It only needs curl.
Questions

IT operations, in plain answers.

Something else on your mind? Talk to our team.

Can TapPass hold a production deploy outside the change window?

Yes. A rule on deploys outside your window holds the action for the person on call, who approves or denies it with a passkey on their own device.

Do secrets end up in the record?

No. Keys and tokens are redacted before a model sees them, and the record keeps redacted content and metadata only.

Does it work with coding agents like Claude Code?

Yes. Claude Code is governed through its hooks: every prompt and tool call is checked, and why the agent stopped is recorded. Other clients connect through MCP.

Can we send the record to our SIEM?

Yes. Every decision streams out as OpenTelemetry to Splunk, Microsoft Sentinel or Elastic.

Give your agents the pager. Keep the change window.

Connect one agent and see every call TapPass would have held, stopped or routed elsewhere. Nothing is blocked while you learn.

✓ Free for one person✓ No credit cardBacked by Start it @KBCVLAIO✓ EU hosted✓ Built in Belgium✓ Your own model keys✓ Encrypted at rest and in transit✓ DPA on request