--- title: "An Agent That Moves Money Needs Row-Level Permissions" slug: "ai-agents-that-move-money-row-level-permissions" author: "Jaione Amigot" date: "2026-09-24 16:00:00" category: "Premium" topics: "AI agent security, row-level permissions, TOLAP, financial services AI, MCP, post-quantum cryptography, agent authorization, data ownership" summary: "AWS open-sourced TOLAP on 22 September 2026 under Apache-2.0: row filtering and column masking enforced inside agent tools, across three SDKs and fourteen framework integrations." banner: "" thumbnail: "" linkedin: | AWS open-sourced TOLAP on 22 September 2026: object-level access control enforced inside AI agent tools. It is a quiet release with a loud implication for financial services. TOLAP — the Tool-Object Level Access Protocol — ships under Apache-2.0 with SDKs in .NET, Python and TypeScript, fourteen agent-framework integrations, and one policy model spanning databases, APIs, knowledge bases and object storage. What it does is unglamorous and exactly right: row filtering, column hiding, field masking and endpoint restriction applied at the source, before any data reaches the agent. AWS's argument is that role-based access control cannot express which rows are visible, and that content guardrails run too late — once unrestricted data is in the context window it is available for summarization, reasoning and extraction by prompt injection. That matters because the tool holds the connection and the agent composes the query. A tool with a database credential and no object-level policy is a tool that will return whatever it is asked for. NVIDIA's 2026 survey of more than 800 financial services professionals found 42% using or assessing agentic AI and 21% with agents already deployed. → An agent that can call a tool is a demo → An agent that sees only the rows its caller is entitled to is a production system → Authorization is an architecture decision, not a prompt → Enforce it at the source, or you are trusting the model to decline With ibl.ai you own all the code and the data — self-hosted inside your own perimeter, model-agnostic across any LLM, usage-based with no per-seat pricing, deployable anywhere from your own cloud to a fully air-gapped network. #iblai #AgenticAI #EnterpriseAI #FinancialServices #AIsecurity #MCP --- ## The Short Answer **AWS open-sourced TOLAP — the Tool-Object Level Access Protocol — on 22 September 2026 under Apache-2.0, enforcing row filtering and column masking inside agent tools before data reaches the model. NVIDIA's 2026 survey of more than 800 financial professionals found 21% have already deployed AI agents. Authorization, not capability, is what makes a money-moving agent shippable in a regulated firm. With ibl.ai you own all the code and the data.** An agent that can call a tool is a demo. An agent that can call a tool and see only the rows its caller is entitled to is a production system. ## What did AWS actually open-source on 22 September 2026? A protocol and three reference implementations for object-level access control inside agent tools, published on the AWS Open Source Blog. [TOLAP — Tool-Object Level Access Protocol](https://aws.amazon.com/blogs/opensource/introducing-tolap-object-level-access-control-for-ai-agent-tools/) is released under **Apache-2.0** at [github.com/awslabs/tolap](https://github.com/awslabs/tolap). It ships SDKs in **.NET, Python and TypeScript**, a reference policy server with an authoring console, and **fourteen integrations** across agent frameworks including the MCP SDK, LangChain, Bedrock Agents and Semantic Kernel. The policy model is one schema over **four source categories** — databases, APIs, knowledge bases and object storage — in three layers: the policy definition, the assignment binding it to a user or group with scope and expiry, and the merged effective policy. What it enforces is deliberately mundane: row filtering, hidden columns, per-field masking, result limits, tag filters on knowledge bases, endpoint restriction on APIs, and prefix allow or deny on object storage. The important word is *where*. AWS puts it this way: "Policy is applied where the data originates, not in a layer above it." So restricted data never enters the agent's context at all. ## Why can't IAM roles give an AI agent row-level permissions? Because role-based access control grants a connection, and the agent composes the query behind it. AWS states the gap plainly: role-based access control cannot specify which columns or rows are visible; attribute-based access control needs centralized routing that agents bypass when a tool holds a direct database connection. That is the structural problem. A tool authenticates once with a service credential, then answers whatever the model asks. Ask for a column the application layer never anticipated, and the column comes back. Content guardrails are the usual patch, and they run too late. Once unrestricted data is in the context window it is, in AWS's wording, "fair game for summarization, reasoning, follow-up questions, and extraction by prompt injection." This is why the defense has to be architectural rather than behavioral. A model instructed not to reveal a field is being asked to decline; a tool that never returns the field has nothing to decline. For a firm that moves money, the distinction is the whole compliance argument. Least privilege scoped to a service account is not least privilege scoped to the person who asked. ## Did ex-Stripe engineers launch a money-moving AI agent the same week? Not on the record, and the correction is worth making because the pairing is what gave the story its force. The claim circulating alongside the AWS release was that ex-Stripe engineers had just shipped an agent that actually moves money. Searching for the launch turns up two real companies, neither of them launched that week. **Circuit & Chisel** was founded by Stripe's former head of crypto and AI partnerships Louis Amira and its former head of crypto engineering David Noël-Romas. It [raised $19.2 million on 22 September 2025](https://fortune.com/2025/09/22/stripe-crypto-alum-agentic-ai-payments-circuit-chisel-atxp/) for ATXP, which Amira described to Fortune as the HTTP for agentic payments — a year to the day before the TOLAP post, which is likely where the "same week" came from. **Natural** [raised $30 million in July 2026](https://techcrunch.com/2026/07/20/natural-raises-30m-to-reinvent-payments-for-ai-agents-and-take-on-stripe/) to let agents move and store funds, but its founders are not from Stripe. So the "same week" coincidence does not hold. What survives is the part that was never about timing: capital is flowing into agent payment rails, and the authorization layer underneath them is being built separately, by other people, later. ## How fast are financial institutions actually deploying AI agents? Faster than the pilot narrative suggests, and slower than the record-speed framing claims. NVIDIA's sixth annual [State of AI in Financial Services survey](https://blogs.nvidia.com/blog/ai-in-financial-services-survey-2026/), published 22 January 2026 and based on more than **800 industry professionals**, found **42%** using or assessing agentic AI and **21%** with AI agents already deployed, with a further **22%** planning deployment within the next year and beyond. One in five in production is a real number, not a record. It is also what makes authorization urgent rather than theoretical, because those deployments sit inside institutions with examiners. A read-only agent that over-returns leaks. A write-capable agent that over-returns leaks and then acts on what it read. This is the same ownership question that arrives when [a software vendor applies for a bank charter](/blog/fintech-saas-becoming-banks-who-owns-the-data-layer): whoever controls the layer that reads your records controls what can be done with them. ## Is post-quantum cryptography a real dependency for financial AI, or a distraction? Real, documented, and on a slower and less certain clock than the alarm version implies. NIST [finalized its first three post-quantum encryption standards on 13 August 2024](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards): **FIPS 203** (ML-KEM) for general encryption, **FIPS 204** (ML-DSA) and **FIPS 205** (SLH-DSA) for digital signatures. NIST's own framing of the timeline is a report of expert opinion, not a forecast: "some experts predict that a device with the capability to break current encryption methods could appear within a decade." Nobody can name a cracking date, and a post that gives you one is guessing. The near-term concern is *harvest now, decrypt later* — encrypted traffic captured today and decrypted whenever the capability arrives. That is why the [G7 Cyber Expert Group](https://home.treasury.gov/policy-issues/international/g-7-and-g-20/g7-cyber-expert-group), co-chaired by the U.S. Department of the Treasury and the Bank of England, published a roadmap for the financial sector's transition. NIST's draft migration guidance, IR 8547, is [Transition to Post-Quantum Cryptography Standards](https://csrc.nist.gov/pubs/ir/8547/ipd), an initial public draft released 12 November 2024, describing its expected approach to moving off quantum-vulnerable algorithms. The practical link to agents is simpler than the cryptography. Both problems are about where enforcement lives. If your agent stack runs on someone else's infrastructure, you do not schedule its cipher migration either. ## How does ibl.ai enforce row-level permissions on agents that move money? By making authorization a property of the platform you run, not a request made of the model. With ibl.ai you own all the code and the data. The platform is self-hosted with full source code access — including the connectors, the policy engine and the agent interfaces — so the components that gate a financial record are ones your team can read and change. Connectors expose each system in place, scoped to the caller's role. A connector resolves a question by querying the system of record at request time and stores nothing, so there is no second copy to govern and no extract to over-return. Above them, one MCP broker acts as a single control plane over many MCP servers, with **deny-by-default RBAC**, credential injection and audit logging. Every agent interaction is logged and auditable, and trails are exportable for SEC, FINRA, SOX and PCI DSS review. Credentials go further than scoping. As of the [18 September 2026 platform release](/updates/platform-update-2026-09-18), an agent sandbox can use a bound secret whose value never enters the guest. The control plane substitutes it host-side, only for that secret's allow-listed hosts, and no endpoint ever returns the value. It is model-agnostic across any LLM, usage-based with no per-seat pricing, and you can deploy anywhere: your own cloud, on-premise, GovCloud, or a fully air-gapped network. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. More on the deployment pattern for regulated firms is on the [financial services solutions page](/solutions/financial-services). ibl.ai is family-owned and operated from New York, NY. *Related reading: [when your software vendor applies for a bank charter](/blog/fintech-saas-becoming-banks-who-owns-the-data-layer) — why the data layer, not the licence, is what locks a finance team in; and [financial AI agents ship as SKUs, integration doesn't](/blog/alphio-financial-agent-aws-marketplace-data-integration-moat) — why the connection, not the agent, is the hard part.* *Sources: TOLAP's licence, SDKs, policy layers and the IAM-gap argument from the [AWS Open Source Blog](https://aws.amazon.com/blogs/opensource/introducing-tolap-object-level-access-control-for-ai-agent-tools/) and [awslabs/tolap](https://github.com/awslabs/tolap); deployment figures from [NVIDIA](https://blogs.nvidia.com/blog/ai-in-financial-services-survey-2026/); Circuit & Chisel from [Fortune](https://fortune.com/2025/09/22/stripe-crypto-alum-agentic-ai-payments-circuit-chisel-atxp/); Natural from [TechCrunch](https://techcrunch.com/2026/07/20/natural-raises-30m-to-reinvent-payments-for-ai-agents-and-take-on-stripe/); the standards and the "within a decade" prediction from [NIST](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards); the initial public draft from [NIST IR 8547](https://csrc.nist.gov/pubs/ir/8547/ipd); the roadmap from the [G7 Cyber Expert Group](https://home.treasury.gov/policy-issues/international/g-7-and-g-20/g7-cyber-expert-group).* ## Why does owning the AI stack matter? **ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.** - **You own all the code and the data.** Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours. - **Model-agnostic.** Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform. - **No per-seat pricing.** Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ. - **Deploy anywhere.** Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.