Amazon Bedrock AgentCore Gateway now supports on-behalf-of (OBO) token exchange for multi-tenant agents. This enables fine-grained access control and secure token handling across tenants using JWT claim transformations. The implementation guide demonstrates integration with Okta and audience binding for enhanced security.
Source preview
Server-side extracted preview paragraphs from the original source.
Building multi-tenant agents with Amazon Bedrock AgentCore and Apply fine-grained access control with Bedrock AgentCore Gateway interceptors establish the conceptual foundation for on-behalf-of (OBO) token exchange in agentic systems.
When you deploy generative AI agents into multi-tenant production architectures, you face a specific identity problem: when an agent calls a downstream API on behalf of a user, whose identity travels with the call?