ReleaseBytes
aws AWS Open Source Blog ·

AWS Open-Sources TOLAP for Object-Level Access Control in AI Agent Tools

blogsecurityawsengineerhealthcareaws-iam
announcement

AWS has open-sourced the Tool-Object Level Access Protocol (TOLAP), addressing a critical gap in fine-grained access control for AI agent tools. This protocol enables source-point enforcement of granular data policies, preventing unauthorized data from entering agent context windows and mitigating prompt injection risks. It is designed for developers building AI agents that interact with sensitive data across diverse sources. TOLAP offers a versioned policy schema, SDKs for .NET, Python, and TypeScript, and integrations with major agent frameworks under an Apache-2.0 license.

  • →AWS open-sources Tool-Object Level Access Protocol (TOLAP)
  • →Explaining the gap in AI agent data access control
  • →TOLAP enforces access control at the data source with object granularity
  • →Key components of the TOLAP open-source repository
  • →TOLAP policy merging ensures most-restrictive-wins behavior
Features (1) ›
  • AWS open-sources Tool-Object Level Access Protocol (TOLAP)

    AWS has released TOLAP as an Apache-2.0 open-source project, providing object-level access control for AI agent tools. This protocol helps solve the challenge of ensuring fine-grained authorization when agents compose queries against various data sources, including databases, APIs, knowledge bases, and object storage.

Notes (5) ›
  • Explaining the gap in AI agent data access control

    Existing access control mechanisms like IAM, OAuth scopes, role-based, or attribute-based access control lack the granularity to define which rows or columns an AI agent tool can access from diverse data sources. Content guardrails operate too late, after unrestricted data is already in the agent's context window, making it vulnerable to prompt injection.

  • TOLAP enforces access control at the data source with object granularity

    TOLAP operates on three core principles: source-point enforcement, where policy is applied where data originates; object granularity, allowing policies to name individual data objects like columns, rows, or fields; and agent transparency, ensuring restricted data simply doesn't appear in what the agent receives.

  • Key components of the TOLAP open-source repository

    The repository contains a versioned policy schema for defining access across various source categories, a normative specification defining enforcement rules, and three SDKs for .NET, Python, and TypeScript with minimal dependencies. It also includes a reference policy server with an authoring console and fourteen integrations for popular agent frameworks such as Amazon Bedrock Agents and LangChain.

  • TOLAP policy merging ensures most-restrictive-wins behavior

    TOLAP policies define granular access, such as hiding specific columns or restricting rows to particular regions. When multiple policies apply to a user, they merge using a 'most-restrictive-wins' logic, ensuring that granting additional policies can only reduce, never expand, the data a user or agent can see.

  • Three-step process for implementing TOLAP access control

    Implementing TOLAP involves resolving a user's effective policy for a data source, signing it into a tamper-evident and time-bound envelope, and then enforcing that policy via the tool on every data call. While the .NET SDK can optimize by pushing row filters to SQL databases, the post-execution pass remains necessary for comprehensive policy enforcement like field masking and complex transformations.

Read the original announcement →

https://aws.amazon.com/blogs/opensource/introducing-tolap-object-level-access-control-for-ai-agent-tools/

Related releases