Introducing TOLAP: object-level access control for AI agent tools

This article introduces TOLAP (Tool-Object Level Access Protocol), an open-source framework for enforcing fine-grained access control on data accessed by AI agent tools.

• Closes the gap where agents can access unanticipated data columns or rows despite passing IAM and OAuth checks
• Provides versioned policy schema, SDKs for .NET, Python, and TypeScript, and integrations with 14 agent frameworks
• Enforces policies at the data source with object granularity: columns, rows, fields, and result limits
• Includes purpose-binding to constrain agents to declared analytical purposes and delegation chains to track authority paths
• Optional LLM judge evaluates semantic alignment of queries within allowed scope
• Reference policy server with PostgreSQL store, audit trails, and key rotation included

TOLAP enables secure, auditable data access for AI agents by applying architectural enforcement at the source rather than relying on guardrails or gateway controls.