{
  "id": 19672991,
  "title": "Fine-grained access control for Amazon Bedrock Managed Knowledge Base tools",
  "url": "https://urgent.news/2026/11/12/fine-grained-access-control-for-amazon-bedrock-managed-knowledge-base",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-12T15:40:24.000Z",
  "source": {
    "name": "AWS Machine Learning",
    "slug": "aws-machine-learning",
    "url": "https://aws.amazon.com/blogs/machine-learning/fine-grained-access-control-for-amazon-bedrock-managed-knowledge-base-tools/"
  },
  "original_language": "en",
  "account": "In the realm of AI-powered applications, enterprises are increasingly integrating agents that search internal documents to formulate responses. An enterprise like AnyCompany, for instance, might utilize an internal assistant accessible to all employees. However, a challenge arises when an agent operates on behalf of a user, as it must ensure that it only accesses information the user is permitted to view.\n\nImagine a scenario where employee A in department A inquires, \"Compare my department's business plan with the notice to all departments, and list the initiatives that are behind schedule.\" If the system fails to restrict searches to the authorized user, employee B in department B could also receive answers containing sensitive information from department A. This issue escalates in a multi-tenant SaaS architecture, where a single assistant serves multiple customer companies.\n\nControlling access in such multi-tenant environments is more complex than in traditional applications, where the application code determines the permissions of the signed-in user. In an agent system, the large language model (LLM) decides which tool to call and with which arguments during runtime, potentially leading to incorrect user attribution due to prompt injections or LLM errors.\n\nTo address this challenge, a solution employs Amazon Bedrock Managed Knowledge Base as the search backend, exposing it to the agent via Model Context Protocol (MCP) tools through Amazon Bedrock AgentCore Gateway. The design principle is to entrust the determination of the user to trusted code, rather than relying on the LLM. Additionally, independent layers of defense are implemented to ensure robust access control.\n\nKey to this solution is the ACL awareness feature of Managed Knowledge Base. When a search request includes a user context (userContext) with the user's email in the userId, the knowledge base returns only the documents accessible to that user. Although this mechanism provides a layer of security, it is not an authorization mechanism on its own and must be fortified with supplementary defenses.\n\nThe architecture injects verified user attributes into tool calls at the tool layer (AgentCore Gateway) and scopes the search by those attributes at the resource layer (Managed Knowledge Base). The process begins with the user signing in through Amazon Cognito, receiving a JSON Web Token (JWT) containing an email claim. This token is then forwarded in the Authorization header when sending MCP requests to the gateway. An AWS Lambda interceptor resolves the email from the validated token and overwrites the userContext argument of tools/call.\n\nThe gateway's policy evaluates the modified request against a Cedar policy, denying the request if the userContext.userId doesn't match the email claim in the JWT. The knowledge base further denies searches from principals other than the execution role of the gateway. This multi-layered approach, combining tool layer and resource layer defenses, ensures fine-grained access control, even if the primary defenses are bypassed.",
  "summary": "Learn how to expose an Amazon Bedrock Managed Knowledge Base to AI agents as MCP tools through Amazon Bedrock AgentCore Gateway while keeping per-user access control. A request interceptor injects verified identity, Policy in AgentCore validates it independently, and a resource-based policy restricts direct access to the knowledge base.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}