Skip to content
TapPass

Dashboard tour

The dashboard (/app) is the control room for everything the kernel does. This tour follows the sidebar. Signing in works with email/password or SSO (Google / Microsoft / SAML, depending on what your org configured).

Command Center — /app/overview

Section titled “Command Center — /app/overview”

Your fleet at a glance over the selected time range (top-right time picker):

  • KPI strip — requests, blocked (with block-rate), cost, p95 governance overhead; each tile shows a period delta and sparkline.
  • Violations over time — stacked area chart; click a legend chip to filter the flagged-events table below.
  • Detection categories, Top risky agents, per-provider compare, and routing savings (what shadow-mode model routing would have saved).
  • Recent flagged events — click a row to open the session.

Agents — /app/agents

Section titled “Agents — /app/agents”

Every registered agent with status, framework, and owner filters. Actions: new agent (drawer with framework-specific setup guides for Claude Code, OpenAI, LangChain, CrewAI, Vercel AI, MCP, n8n…), pause/resume governance, suspend, delete.

Agent detail (/app/agents/{id}) is where most work happens:

Tab What it shows / does
Governance The agent’s effective policy — every rule that applies, with the scope layer it came from. Attach/detach policies, add a scoped rule, view assignments.
Sessions This agent’s sessions, filterable.
Audit This agent’s audit events.
Developer keys Mint/revoke tp_dev_… keys (shown once).
Runtime config Per-runtime config (e.g. Claude Code).

Sessions — /app/sessions

Section titled “Sessions — /app/sessions”

Every session with status facets and search. A session detail is the full trace: each governed action as a span, the rules that fired, and a one-click “Open applied rule” jump into the owning policy. This is your first stop when an agent misbehaves.

Audit Trail — /app/events

Section titled “Audit Trail — /app/events”

Two lenses on the same signed trail:

  • Denial timeline (default) — a governance view: what was blocked/escalated, when, why.
  • Classic activity log — full filterable/searchable event log with export.

The integrity status of the hash chain is shown inline (GET /api/audit/integrity) — see the audit trail.

Policies — /app/policies

Section titled “Policies — /app/policies”

All policies with status pills (active / shadow / draft / retired) and scope badges. Policy detail has three tabs:

  • Rules — add rules from a catalog of rule kinds grouped by category (the same kinds as the rule reference). Each kind renders a form — tool/model/domain fields are pickers backed by live catalogs. Every rule has an Enforce / Watch (shadow) mode selector. You can also describe the agent’s purpose in plain English and get a suggested capability envelope.
  • Versions — every version, its rules, and the Publish action (with pre-publish blast-radius preview). Nothing enforces until published.
  • Advanced — inspect the effective policy the kernel evaluates.

Assign to a scope attaches the policy at org / project / team / agent level. See lifecycle & rollout.

Approvals — the bell, then /app/approvals

Section titled “Approvals — the bell, then /app/approvals”

Approvals deliberately have no sidebar entry — they come to you. The bell shows a live count (streamed over SSE); clicking through opens the inbox:

  • Pending items grouped by urgency, with live expiry countdowns, the matched rule, the tier chip, and amounts where relevant.
  • The detail panel shows the exact arguments (the approval binds to them cryptographically — nothing is hidden) and what the engine already verified: PII, secrets, injection, privilege escalation — each ran/ok/flagged.
  • Signed tier: approve with your passkey (Touch ID / WebAuthn) — the decision is a signed assertion chained into the audit trail. Authenticated tier: one-click approve.
  • Deny is always available, with a confirm dialog.

Tool-discovery approvals (a newly-seen tool awaiting catalog admission) also appear here, with a capability picker written to the org catalog on approval.

Integrations — /app/integrations

Section titled “Integrations — /app/integrations”

Active integrations (Gmail, Slack, GitHub…) with OAuth connect flows and grant scopes, plus a curated catalog and live MCP registry search. Org admins add; everyone sees status.

Playground — /app/playground

Section titled “Playground — /app/playground”

Send a live prompt through policy and watch the decision happen — the fastest way to test a rule change without touching an agent.

Connect — /app/connect/*

Section titled “Connect — /app/connect/*”
  • Agent SDK — copy-paste Python snippets with your deployment’s gateway URL filled in.
  • Platform CLI — CLI install and PAT login instructions.
  • API Keys & Tokens — your PATs; per-agent developer keys live on each agent’s page.

Settings — /app/settings

Section titled “Settings — /app/settings”

Workspace (name, brand), LLM provider keys (BYOK), projects, teams, users (invite/suspend).

Profile — /app/profile

Section titled “Profile — /app/profile”

Your passkeys (WebAuthn devices used for signed approvals), personal access tokens (tp_pat_… for the CLI/API), and account deletion.

Moving fast

Section titled “Moving fast”
  • ⌘K — command palette: navigate anywhere, jump to any agent, switch project, register an agent.
  • ➕ (top bar) — new agent / policy / project / team / integration.
  • ✦ — Jorge, the AI copilot: ask questions about your governance data in natural language.

Next steps

Section titled “Next steps”