Tool result
Access control for what your AI agents read.
An agent allowed to call a tool reads everything that tool returns. Lacuna Layer decides which fields reach its context window, by role, on every tool call.
Industry
Read as
One tool result, read differently by each agent
-
Healthcare
Minimum necessary, per agent.
An agent that can open the chart receives all the PHI in it. Here the care agent reads the diagnosis, billing reads the name and the procedure, and research reads clinical data with no identity.
-
Financial services
Need-to-know inside the document.
Entitlements decide which memos an agent can retrieve, not which lines it reads. Here credit reads the watchlist status, procurement reads the terms, and only compliance reads the regulator's finding.
-
HR and people
No more oversharing of pay and health.
An assistant that inherits a user's permissions surfaces whatever that user can technically open. Here payroll reads the salary, occupational health reads the diagnosis, and the manager's assistant reads only the outcome.
-
Logistics
Buy rate, sell rate and margin stay on your side.
A TMS holds the whole book of business. Here the tracking agent reads the delivery address, pricing reads the rates, and the carrier-facing agent sees neither the margin nor the customer.
-
Your domain
Book a callDifferent industry, same problem.
Legal, insurance, public sector, or anything else your agents read. The detector can be fine-tuned on your documents and labels, and each agent role gets its own policy.
Questions about agentic access control
What is agentic access control?
Deciding what an AI agent may do and what it may see. Most products cover the first half: agent identity, scopes, and which tools an agent can call. Lacuna Layer covers the second half: what the agent reads, decided by its role and purpose.
Our agents inherit the user's permissions. Is that not enough?
Inherited permissions decide which records an agent can open. Inside a record it still reads every field, including ones that user would never be shown on a screen. That is how assistants end up oversharing pay, health and deal data.
How is this different from an MCP gateway or IAM?
Those authorize the call. They do not shape the response. An agent allowed to query the CRM still receives every field the CRM returns. Lacuna Layer applies least privilege to the data itself, and works alongside the gateway you already have.
Is this the same as PII redaction?
PII masking hides the same values from everyone. Role-based redaction releases a salary to the payroll agent and withholds it from the support agent, from a single detection pass.
Can a prompt injection make it release a field?
The redaction path has no prompt. Detection is a token classifier and the policy is a lookup table, so instructions hidden in a document are not followed.
Where does it run?
Inside your network. The detector is a small model that runs on your own hardware, and tool results do not leave it.
Bring one tool your agents call.
On a call we map which agent roles should read which fields, using your own tool results.
Book a call