We have been building and deploying AI solutions for enterprises for years. Automation agents, data processing pipelines, customer-facing assistants. Real deployments in regulated industries, not proofs of concept.
And the same questions kept coming back. Every single time.
What happens if the agent accesses data it shouldn't? How do we prove to the auditor what it did? What if it runs away and burns through our budget overnight?
These were not hypothetical concerns. They were things that happened. An agent that looped for hours because nobody set a budget limit. A customer service bot that surfaced internal pricing data. An operations agent that ran for six months before anyone in security even knew it existed.
We kept building the same guardrails from scratch. Custom logging. Manual budget checks. Ad hoc access controls. It worked, but it didn't scale. And it would not survive an audit.
What kept coming back
- VisibilitySecurity did not know how many agents were running or what data they touched.
- IdentityShared API keys. Can't tell agents apart, can't scope permissions, can't revoke one without breaking all.
- EnforcementPolicies on paper. No runtime mechanism to enforce what agents were allowed to do.
- Audit trailLogs captured prompts but missed tool calls, data flows and decision chains.
- Proportionality"Block everything" or "allow everything." No way to right-size governance per agent.
We looked at what existed. Prompt filtering tools. Observability platforms that logged but did not enforce. Ethics frameworks that produced documentation but no runtime controls. None of them solved the actual problem.
So we built it
TapPass started as the governance layer we needed for our own projects. A proxy between agents and model providers. Every request evaluated against policy. Every action logged.
We did not set out to build a product. We set out to stop rebuilding the same guardrails every quarter. But the more we used it, the more we realised every enterprise deploying AI agents needed this.
- Runtime, not documentation. Controls that enforce, not guidelines that suggest.
- Proportional, not binary. Granular governance that fits each agent individually.
- Evidence, not assertions. Tamper-evident logs, not a developer's recollection.
- Enablement, not prevention. More agents with confidence, not fewer agents out of fear.
Why Europe
TapPass is built in Belgium and runs on European infrastructure. Deliberate choice, not geographic accident.
The EU AI Act enters full application on August 2, 2026. European enterprises need governance built by people who understand European regulatory requirements, data residency, and the reality of operating under GDPR, DORA and the AI Act simultaneously.
If we can build governance that satisfies European requirements, it works everywhere.
What we believe
We are not building TapPass because we think AI is dangerous. We are building it because AI is valuable, and that value is at risk without governance.
Every CISO who blocks AI adoption because the risk is unquantifiable is making a rational decision. But the opportunity cost is also real. The answer is not to avoid the technology. It is to govern it well enough that the CISO can say yes.
We want to take an active part in AI innovation. In a governed way. That is not a contradiction. It is the whole point.
