What you can do with TapPass
TapPass governs what your AI agents are allowed to do. These five use cases are the fastest ways to get value out of it from the tappass CLI — each one is a self-contained flow you can run today.
| Use case | What it gets you | Command |
|---|---|---|
| Govern an agent from a sentence | A least-privilege policy without hand-authoring rules | tappass policy create --from-prompt "…" |
| The verdict API | A yes/no/needs-approval decision before you act — no gateway in the hot path | POST /v1/govern |
| Explore the capability database | See every intent and the tools that cover it | tappass capability list |
| Watch mode → proposed policy | Policy derived from what the agent actually did, not guesswork | tappass activity cube · --from-observed |
| TapPass as the gateway | Governance in-path, plus two ways to wire LiteLLM | swap base_url |
Two ways to deploy governance
Section titled “Two ways to deploy governance”Before you pick a use case, it helps to know the two shapes TapPass can take:
- Beside your app (verdict API). You ask TapPass for a decision, then you execute the action yourself. TapPass is never in the request path — it’s a policy oracle. See the verdict API.
- In front of your app (gateway). Your agent’s LLM and tool calls flow through TapPass, which governs, executes, and audits them. See TapPass as the gateway.
Most teams start with one and add the other. The policy you author (use case 1) and the capabilities you explore (use case 3) are identical in both.
New here?
Section titled “New here?”If you haven’t made a governed call yet, start with the Quick Start and Your First Agent — then come back here to go deep on the flow you care about.