AWS announced the OBO token exchange feature for Amazon Bedrock AgentCore Gateway, allowing AI agents to maintain user identity when calling enterprise APIs. This feature is designed for AI agents that interact with APIs on behalf of users, ensuring that API calls preserve the user's identity and comply with security principles.
What happened
AWS has introduced an on-behalf-of (OBO) token exchange feature for Amazon Bedrock AgentCore Gateway. This feature enables AI agents to maintain user identity when interacting with enterprise APIs, such as the ServiceNow REST API. Without identity propagation, API calls arrive at downstream services as the application itself, breaking audit trails and bypassing user-level access controls. The OBO token exchange ensures that the calling user’s identity is preserved throughout the request chain. This is achieved by configuring the token exchange on the gateway target, and AgentCore Gateway performs the exchange on each request. The solution involves three key components: an AI agent application, a Model Context Protocol (MCP) server, and the ServiceNow REST API. The configuration includes setting up OAuth as the outbound identity provider and specifying the necessary scope and custom parameters. In production, identity propagation can be paired with Amazon Bedrock Guardrails to filter harmful content and validate the agent’s inputs and outputs.
In the Fathom Layer index
- Model Context Protocol (MCP) — MCP Servers
FAQ
How does the OBO token exchange work?
The gateway receives the agent’s JWT, sends the token to Entra’s token endpoint with the OBO grant type, and Entra issues a new token with the original user’s claims.
What is the scope used for the token exchange?
The scope is api://5d4a7a11-xxxx-xxxx-xxxx-xxxxxxxxxxxx/user_impersonation.
What is the custom parameter required for the token exchange?
The custom parameter is requested_token_use:on_behalf_of.
Source: Amazon Web Services