One authority layer. The rules you are held to.
Every industry on this page runs the same TapPass: agents get least privilege per tool, risky calls wait for a person, and every decision lands on a tamper-evident record. What changes is which rules matter, which data must never move, and who has to be able to prove it later.
A generic AI policy does not survive an audit. A specific one does.
“Be careful with customer data” is not a control. “This agent may read a claim but never export policyholder records, and any payout over €500 waits for a named approver” is. TapPass exists to turn the second kind of sentence into something that actually fires, in the moment the agent tries to act, for the industry you are in.
Where TapPass is already shaped for the work.
Financial services
Agents that touch customer money need more than a prompt asking them to behave. Payment and refund caps that hold, PII that never leaves the perimeter, and a DORA-shaped record of who decided what.
Explore →Insurance
Underwriting and claims automation is a high-risk decision system the moment a model is in it. Keep policyholder data contained, keep the reasoning reviewable, and keep Solvency II and the EU AI Act answerable.
Explore →Healthcare
Patient data under GDPR Article 9 does not get a grace period while you experiment. Redact before the call leaves, hold clinical-adjacent actions for a human, and show the trail to your DPO without a reconstruction project.
Explore →Legal
Privilege is a property of where the data went, not of your intentions. Enforce matter-level separation and Chinese walls at the tool boundary, and keep a per-engagement record of every AI touch.
Explore →Government & public sector
Citizen data rarely gets to leave the building, and it should not have to. Run TapPass in your own tenancy, whitelist the models you will accept, and align with NIS2 and the EU AI Act on your own infrastructure.
Explore →Consulting & professional services
Every engagement is someone else’s confidential material. Scope an agent to one client’s tools and data, prove the wall held, and hand the client an audit trail instead of an assurance.
Explore →SaaS & technology
Shipping an AI feature means shipping your tenancy model to a model provider. Keep tenant isolation intact, govern what your agents may reach on a customer’s behalf, and arrive at SOC 2 with evidence already collected.
Explore →The layer does not care what you sell.
Startups
Move fast without building a governance layer you will have to rip out at your first enterprise deal. Start free, add rules as customers ask for them.
For startups →By use case instead
If the work matters more than the sector, start from what the agents actually do: IT operations, OT and industrial systems, or business processes like finance and support.
Browse use cases →Different regulators. The same three guarantees.
Least privilege, per tool and per team, so an agent holds the three tools its job needs instead of the thirty-four a server happens to expose. A human on the calls that deserve one, routed to Slack, email, or a strong-authentication tap. And a tamper-evident record of every allow, hold and block, streaming to the SIEM you already run. Nothing here is industry-specific. Only the thresholds are.