TAP
Credential isolation for AI agents. Stop giving your agents secrets.
TAP (long form: Tool Authorization Protocol) is a credential proxy. Agents call APIs by credential name and never see the secret values. Sensitive calls can pause for human approval.
The problem
An agent that reads an API key from its environment has put that secret in several places at once: the process environment, every subprocess it spawns, crash dumps, and any log line that stringifies config. Prompt-injected output can then ask the agent to print it. The blast radius of one compromised agent becomes every service that agent could reach.
Scoping an agent’s actions does not solve this. An agent holding a raw key can always use it directly, whatever the policy above it says.
How it works
- Credentials live in TAP, not in the agent. You add them once through the dashboard.
- The agent references a name. Its config maps destinations to credential names. It never receives a value.
- TAP injects at the trust boundary. The outbound request is rewritten server-side with the real credential, sent upstream, and the response comes back with credential values scrubbed.
- Sensitive calls can gate on a human. Optional approval checkpoints pause a request until a person confirms it, over Telegram or Matrix.
- Every call is audited. The proxy sees the full request, so there is one place to answer what an agent actually did.
On the hosted service, credentials sit in a hardware enclave that human.tech cannot read into. Each release’s enclave measurement is published in the measurements/ directory of the open-source repo.
Where it fits
TAP and WaaP cover the two halves of agent authority, and they are not interchangeable:
| Governs | Mechanism | |
|---|---|---|
| WaaP | What an agent can spend | Split-key signing plus a policy engine. The agent never holds the signing key. |
| TAP | What an agent can call | Credential proxy. The agent never holds the API key. |
An agent that pays for an API needs both: TAP so the call is authorised without the key ever reaching the agent, WaaP so the payment is bounded by policy the agent cannot edit. See For AI Agents.
Get started
- Hosted. tap.human.tech — free to start, no infrastructure to run. Recommended.
- Developer docs. docs.tap.human.tech — setup, API reference, connectors, self-hosting guide.
- Source. holonym-foundation/tap-oss — Apache-2.0. Proxy, storage, approval bots, remote MCP server, and CLI.
Self-hosting is a real option and a real responsibility: it puts host hardening, key isolation, and correct policy-engine operation on you. Teams without a security function should use the hosted service.