Sandboxes & enforcement

Governance is intention based: TapPass governs what routes through it. On its own that is a strong default, but a determined or misconfigured agent could try to reach a model or a tool directly. A sandbox closes that gap: it confines what the agent can reach at all, so the TapPass request path becomes the only path.

This page explains what that delivers and how it enforces, end to end, for Claude Code today and for NVIDIA OpenShell.

Guaranteed enforcement is three layers working together. Each answers a different question.

The decision has to live in the request path, because that is the only place both the intent and the tool semantics are legible and the action has not happened yet. The sandbox makes that decision non-bypassable. The observation layer is a slow learning loop, never an input to the real-time decision.

Claude Code can be fully governed today, on all three layers.

1. Model calls, through the gateway. Point Claude Code at TapPass, so every model call is governed and recorded:

export ANTHROPIC_BASE_URL=https://app.tappass.ai
export ANTHROPIC_API_KEY=<your TapPass key>

2. Tool calls, through the PreToolUse hook. Register the TapPass hook in .claude/settings.json. Before each tool runs, Claude Code asks TapPass for a decision; a block refuses the tool before it executes:

{
  "hooks": {
    "PreToolUse": [
      { "matcher": "*", "hooks": [ { "type": "command", "command": "tappass-claude-code-hook" } ] }
    ]
  }
}

The hook exits 0 to allow and 2 to block, and it is fail-closed by default: if TapPass is unreachable, the tool does not run. See Claude Code hooks.

3. Confinement, through the sandbox. Launch Claude Code inside a sandbox so it cannot reach anything except TapPass:

tappass run --sandbox claude     # governed + sandboxed

A Claude Code session where every model call and every tool call is decided before it runs and written to the audit trail, and where the agent cannot reach around that path because the sandbox confines its egress. The governed path is the only path.

• The hook blocks a tool call before execution (exit 2), with the reason surfaced to the agent.
• The gateway is the only route to a model, and it governs each call.
• The sandbox denies any other egress, so neither the model nor a tool can be reached directly.
• Everything is fail-closed: no decision, no action.

NVIDIA OpenShell is a secure runtime that confines an agent and enforces reachability policy outside the agent process. It is the confinement layer in the table above, at the operating-system level.

How TapPass fits. OpenShell constrains what the agent can reach, so the TapPass request path is the only path. TapPass then makes the appropriateness decision in that path, before the action, where intent and tool semantics are legible, and keeps the auditor-grade record of why. TapPass sits on top of the substrate and is made non-bypassable by it.

What is available today. The sandboxed launcher above (tappass run --sandbox) confines the agent so the governed path is the only path.

What is coming soon. Deeper two-way sync with NVIDIA OpenShell and its Sentry watchdog: Sentry’s out-of-band activity records feed a learning loop that sharpens the next TapPass decision under human ratification. That loop runs after the fact, on a different clock, and is never an input to the real-time gate.

1. OpenShell confines the agent’s egress to TapPass.
2. The agent’s model and tool calls arrive at TapPass in the request path.
3. TapPass decides before the action, returns allow, block, or needs-approval, and records the decision and the rule behind it.
4. Sentry observes out of band and, coming soon, feeds those observations into the policy learning loop for the next decision.

• Default governance (repoint a base URL, add the hook) is enough when you trust the connected path and want visibility and control.
• Confinement (sandbox) is for when you must guarantee that an agent cannot reach a model, a supplier, or a tool you did not approve, for example a regulated workload or an untrusted agent.

See What TapPass can and cannot govern for the shorter version, and MDM for locking a managed app’s configuration so it can only reach TapPass.