Metadata-Version: 2.5
Name: tolap-core
Version: 1.0.0
Summary: TOLAP SDK Core - policy models, merge algorithm, HMAC signing, enforcement engine
Project-URL: Homepage, https://github.com/awslabs/tolap
Project-URL: Repository, https://github.com/awslabs/tolap
Project-URL: Issues, https://github.com/awslabs/tolap/issues
Project-URL: Changelog, https://github.com/awslabs/tolap/blob/main/CHANGELOG.md
Author: Amazon.com, Inc. or its affiliates
License-Expression: Apache-2.0
License-File: LICENSE
License-File: NOTICE
Keywords: access-control,ai-agents,data-masking,mcp,security,tolap
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Typing :: Typed
Requires-Python: >=3.10
Description-Content-Type: text/markdown

# tolap-core

Part of [TOLAP](https://github.com/awslabs/tolap) -- the Tool-Object Level Access Protocol.

Policy models, the most-restrictive-wins merge algorithm, HMAC signing over a canonical form, and the enforcement engine. **No runtime dependencies** -- crypto, JSON and collections come from the standard library.

## Install

```
pip install tolap-core
```

## What TOLAP does

When an AI agent queries a database or calls an API through a tool, IAM and OAuth decide
*whether the agent may invoke that tool*. Neither decides *which rows and columns this
particular user may see through it*. TOLAP moves enforcement inside the tool, at the
data-object level: column hiding, row filtering, field masking, tag-based access and
endpoint restrictions, applied before any data reaches the agent.

One policy schema covers databases, APIs, knowledge bases and object storage. Policies are
merged most-restrictive-wins, then HMAC-signed so they can cross process and network
boundaries tamper-evidently. A context signed by any one of the three SDKs verifies in the
other two.

## Documentation

- [Repository and full README](https://github.com/awslabs/tolap)
- [Architecture guide](https://github.com/awslabs/tolap/blob/main/docs/architecture.md)
- [Canonical enforcement specification](https://github.com/awslabs/tolap/blob/main/docs/canonical-enforcement-spec.md) -- normative cross-language behaviour
- [Threat model](https://github.com/awslabs/tolap/blob/main/docs/security/threat-model.md)
- [Integration examples](https://github.com/awslabs/tolap/tree/main/examples) -- fourteen agent frameworks, each CI-tested

## Security

Enforcement is non-bypassable *where the wrapper is the only path to the data source*. A
tool that reaches a source without going through a wrapper is outside the boundary. See
[known limitations](https://github.com/awslabs/tolap/blob/main/docs/canonical-enforcement-spec.md#13-known-limitations)
for the full list of what TOLAP does not guarantee, and
[SECURITY.md](https://github.com/awslabs/tolap/blob/main/SECURITY.md) to report an issue.

## License

Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
