Skip to content

Core Concepts

Every agent request passes through a multi-step pipeline in three phases:

  1. Input scanning: PII detection, prompt injection detection, data exfiltration checks
  2. Execution: LLM or tool call with permission enforcement
  3. Output scanning: DLP, taint tracking, response classification

A block at any step stops the request immediately. The agent receives a PolicyBlockError with the reason.

After the pipeline passes, TapPass mints an Ed25519-signed capability token: a cryptographic proof that the request was scanned and approved. Tokens are:

  • Time-bounded: valid for 60 seconds
  • Action-scoped: list exactly which tools are allowed
  • Verifiable offline: no network call needed to validate

Agents start with minimal permissions and earn access over time:

TierWhat it can do
ObserverRead workspace only, no shell, no network
WorkerSafe commands, workspace read/write, fetch only
StandardMost commands, system-wide reads
FullEverything (audit-only mode)

See Sandbox and Trust Tiers for the full reference.

One-header governance: X-TapPass-Flags: mode=observe, pii=mask, email=block. Control agent behavior without editing YAML or Rego policies.

See the Governance Flags guide for all available flags and their values.

Every request is automatically classified:

LevelExample content
PUBLICGeneral knowledge questions
INTERNALCompany processes, non-sensitive business data
CONFIDENTIALFinancial data, customer information
RESTRICTEDPII, credentials, regulated data

Classification drives model routing, tool permissions, and audit detail level.

Values carry labels (PII, SECRET, EXTERNAL) through the pipeline. If tainted data reaches a dangerous sink (shell, email, external API), it is blocked. Taint persists across requests within a session.

All policy decisions are made by Open Policy Agent using Rego rules. TapPass enforces OPA’s decisions. If OPA is unreachable, all requests are denied (fail-closed).

You now understand the core concepts. Continue to the Python SDK reference for the full API, or jump to Providers to connect your LLM.