Artificial Intelligence1 min read

Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1

By · Published by Everything Blog

In short

The joint architecture delegates user-agent permission decisions to Okta while relying on Amazon Bedrock AgentCore to manage runtime tool execution. The workflow protects systems by converting authorization grants into short-lived access tokens stored safely in a dedicated token vault. In practical performance benchmarks, credential redemption added only about 0.6 seconds of latency to a standard 30-second end-to-end request. Implementing this setup requires access to an AWS account configured with Amazon Bedrock AgentCore and an Anthropic Claude model.

Key points

  • Amazon Bedrock AgentCore Identity safely isolates sensitive enterprise credentials away f…: Amazon Bedrock AgentCore Identity safely isolates sensitive enterprise credentials away from the agent's actual code.
  • Downstream resources like Model Context Protocol servers receive only short-lived access…: Downstream resources like Model Context Protocol servers receive only short-lived access tokens backed by explicit permissions.
  • A planned expansion will integrate Cedar policies, Amazon CloudWatch audit logging, and w…: A planned expansion will integrate Cedar policies, Amazon CloudWatch audit logging, and workloads on Amazon Elastic Kubernetes Service.

Sources checked by our analysis pipeline: 1

Artificial Intelligence

Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1

An AI agent that updates a ticket or reads a customer record acts for a person, inside applications that person can reach. Your identity team then has to answer a question that per-app OAuth consent and shared service accounts leave open: which agent might act for which user in which application, and how you stop it. Okta Cross App Access (XAA) answers it in your identity provider (IdP). You register the agent in Okta, an administrator approves the applications it might reach, and Okta evaluates policy each time the agent asks to act for a user. In our tests, after an administrator removed a user’s assignment to the agent, Okta refused the agent’s new requests for that user within about 1 second, and tokens already issued expired within 5 minutes.

Amazon Bedrock AgentCore is a platform to build, connect, and optimize agents at scale, with any framework or model. This solution uses two of its capabilities to carry out Okta’s decision on…

Artificial Intelligence