Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1
An AI agent that acts for a user raises an identity question that per-app OAuth and service accounts leave open: which agent may act for which user, and how you stop it. In this first post of two, you build a task agent on Amazon Bedrock AgentCore that governs access through Okta Cross App Access and AgentCore Identity, and enforces each user's authority.
An AI agent that performs tasks within applications is governed by Okta Cross App Access (XAA) and Amazon Bedrock AgentCore, as detailed in Part 1 of this post. The identity team faces a challenge in determining which agent should act for which user in which application, and how to stop unauthorized actions. Okta XAA addresses this issue within the identity provider (IdP).
Registering the agent in Okta, an administrator approving the applications it can access, and Okta evaluating policies each time the agent requests action for a user are all part of the process.
In the solution architecture (Figure 1), the agent and the Model Context Protocol (MCP) servers it calls all run on AgentCore runtime. The three tokens involved in the request are the ID token, the Identity Assertion JWT Authorization Grant (ID-JAG) issued by Okta, and the access token accepted by the resource. The user signs in through the web front end with OpenID Connect, and the backend for frontend (BFF) exchanges the user's ID token for an ID-JAG at Okta's org authorization server.
The BFF then invokes the agent on AgentCore runtime, which receives a workload access token from AgentCore Identity that binds the agent's workload identity to the user.
The agent uses AgentCore Identity to redeem the ID-JAG at the resource's Okta custom authorization server, and the access token is returned to the agent. The task manager checks the agent's authorization before the agent proceeds to call the MCP servers with the access token. The timing of Okta's controls is measured in this post, with AgentCore Identity adding approximately 0.6 seconds to a request that took about 30 seconds end-to-end.
Part 2 of this post will expand the governance to Amazon Bedrock AgentCore Gateway with additional components and auditing.
Written by urgent.news from AWS Machine Learning's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
