The TapPass path

From first governed call to a managed fleet — five stages, each linking a deeper guide. You don’t have to walk them in order, but each one builds on the evidence the previous stage produced.

1. Connect your agent

Swap the base URL your app already uses for your TapPass gateway URL, and every call flows through governance — no code changes. If a gateway isn’t the right shape for your setup, pick another surface: the verdict API, hooks, or the governed MCP endpoint.

Quick Start — first governed call in about three minutes
Ways to connect — gateway, verdict API, hooks, MCP: how to choose
Integrations — per-provider, framework, and IDE walkthroughs

Start with: export OPENAI_BASE_URL=<gateway>/v1 and your tp_ key.

2. Set up your policy

Don’t author rules from a blank screen. Start from a curated template or describe the agent’s job in a sentence — TapPass drafts the smallest capability envelope that lets it work. New policy lands in shadow mode first: decisions are recorded, nothing blocks, and you switch to enforce when the evidence looks right.

Govern an agent from a sentence — one prompt to a right-sized policy
Templates — tested starting points with parameters
Authoring policies — write and edit rules yourself
Lifecycle & rollout — draft → shadow → enforce, and back

Start with: tappass policy create --org-id <org> --name support -i --from-prompt "handles support email" — -i makes it a working session: TapPass proposes the rules, you refine in plain language, and only what you approve is created

Then test it: run a governed loop and watch your policy act — tappass try "draft a reply to this customer" --dry-run shows every would-be tool call and its verdict without executing anything, streamed live from the server to any laptop. tappass chat "…" sends one governed call through the same pipeline, and tappass policy explain answers “would this block?” before you ever flip to enforce. (These reason with a model — the server needs an LLM key.)

3. Watch your footprint

See what your agents actually do before you tighten anything. The activity cube pivots governed calls, blocks, tokens, and cost by tool, agent, or provider; the audit trail keeps the verifiable record of every decision; and live session streams show a run as it happens.

Watch mode → proposed policy — derive policy from behavioral evidence
The audit trail — the record behind every verdict (tappass audit list)
Live runs — tappass session watch streams sessions as they execute

Start with: tappass activity cube -g tool — one table of calls, blocked, and cost per tool.

4. Manage your workspace

Once more than one person or agent is involved, structure it: organizations hold projects and teams, members get invited and scoped, humans approve what policy escalates, and identity comes from your SSO provider.

CLI: identity and org structure — the org, project, team, and approval command groups
Dashboard tour — the same management surface, in the browser
Identity / SSO — Azure AD, Okta, Google Workspace, SAML

Start with: tappass org members add --email teammate@example.com — or open the dashboard’s members page.

5. Operate at scale

Run TapPass on your own infrastructure, tune its configuration, stream events to the SIEM your security team already watches, and export compliance evidence straight from the audit trail.

Self-hosting — Docker Compose or source, plus the production gate
Configuration — every knob, documented
Observability / SIEM — Splunk, Sentinel, webhooks
Compliance evidence — GDPR, EU AI Act, SOC 2 exports

Start with: the self-hosting guide, then wire up your SIEM.

Where you are now

Nothing connected yet → stage 1: the Quick Start.
Calls flowing, but only the platform safety floor applies → stage 2: apply a template or describe the job.
Policy in shadow, deciding what to enforce → stage 3: tappass activity cube -g tool and watch mode.
Teammates asking for access → stage 4: workspace management and SSO.
Security or compliance wants it in their stack → stage 5: self-hosting, SIEM export, evidence.