Pipeline Step Reference

TapPass runs a 49-step governance pipeline on every agent request. Steps are organized into three phases and grouped by category.

Phase: Before the LLM

Access Control

Step	Position	Description
`validate_input`	100	Validate request structure and schema
`rate_limit`	110	Token-bucket rate limiting per agent/org
`budget`	120	Monthly USD budget enforcement

Data Protection

Step	Position	Description
`detect_pii`	200	Presidio + ML-based PII detection (names, emails, phone numbers, etc.)
`pii_tokenize`	210	Replace PII with reversible tokens
`detect_secrets`	220	API keys, passwords, connection strings
`detect_infra`	230	Infrastructure identifiers (IPs, hostnames, ARNs)
`detect_business`	240	Business-sensitive data (revenue, customer counts)
`detect_unicode`	250	Unicode homoglyph and invisible character attacks
`classify_data`	260	Assign data classification (PUBLIC → TOP SECRET)

Threat Detection

Step	Position	Description
`detect_injection`	300	5-category prompt injection detection (direct, indirect, jailbreak, role hijack, context manipulation)
`detect_escalation`	310	Privilege escalation attempts (sudo, admin, system prompt override)
`detect_tool_poison`	320	Tool description manipulation and rug-pull detection
`detect_exfiltration`	355	Data exfiltration via paste services, DNS tunneling, webhooks, cloud storage, base64 encoding
`detect_memory_poison`	360	Memory/identity poisoning: MEMORY.md writes, identity override, persistent injection, time bombs, MCP abuse, context poisoning
`detect_insider_threat`	365	AI misalignment detection: self-preservation, blackmail, deception, unauthorized sharing, phishing (session-aware accumulation)

Phase: The Call

Route & Execute

Step	Position	Description
`call_llm`	600	Route to LLM provider (OpenAI, Anthropic, Azure, Ollama, etc.)
`call_tool`	610	Execute MCP tool calls
`tool_permissions`	620	Check tool allowlist / denylist per agent
`tool_constraints`	625	Parameter validation and value constraints on tool calls
`filter_tools`	630	Remove tools the agent shouldn’t see
`scan_tool_calls`	635	Inspect tool call arguments for path traversal, injection, forbidden zones
`require_approval`	640	Human-in-the-loop gate for high-risk tool calls
`detect_code_exec`	650	Shell command inspection (31 dangerous patterns: sudo, suid, crontab, scp, iptables, etc.)

Phase: After the LLM

Response Safety

Step	Position	Description
`scan_output`	700	DLP scan on LLM responses
`content_safety`	710	Toxicity, bias, and harmful content detection
`taint_check`	720	Taint tracking: block PII/secrets from reaching public sinks
`shell_bleed`	730	Detect shell prompts and terminal escape sequences in output
`pii_restore`	740	Reverse PII tokenization for authorized consumers
`scan_tool_results`	750	Inspect tool return values for sensitive data

Tracking

Step	Position	Description
`cost_tracking`	800	Token usage and cost attribution
`loop_guard`	810	Detect infinite agentic loops

Configuration

Each step supports:

on_detection: block, redact, log, or continue
threshold: Score threshold for ML-based steps (0.0–1.0)
Custom configuration fields per step

detect_injection:
  on_detection: block
  threshold: 0.5

detect_exfiltration:
  on_detection: block

detect_memory_poison:
  on_detection: block
  threshold: 0.6

detect_insider_threat:
  on_detection: block
  threshold: 0.7

Presets

Preset	Steps	Use case
Starter	11	Low-risk internal agents
Standard	37	Production agents with external access
Regulated	43	Financial services, healthcare, government