AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Propagate user authorization context in AI agents with Amazon Bedrock AgentCore

infonews

securitypolicy

Source: AWS Security BlogAugust 19, 2026

Summary

When AI agents (software that performs tasks autonomously) access multiple data sources, they need to know who is asking so they only return data that user is allowed to see. Amazon Bedrock AgentCore can be configured to propagate user authorization context (information about which user is making the request and what they're permitted to access) through downstream services, so access control is enforced by the infrastructure and data sources rather than by the agent code itself.

Solution / Mitigation

The source describes an architecture pattern: (1) User authenticates with Amazon Cognito (an identity provider), which enriches JWT tokens (JSON Web Tokens, a way to securely pass user information) with custom claims and session tags; (2) Bedrock AgentCore Runtime validates the JWT and issues a workload access token binding user and agent identities; (3) For internal documents, the agent queries Amazon Bedrock Knowledge Bases with metadata filtering and DynamoDB using user-scoped session-tagged credentials; (4) For external data, Bedrock AgentCore Identity retrieves credentials from AWS Secrets Manager and performs an on-behalf-of token exchange (RFC 8693) with Salesforce, returning a user-scoped access token; (5) The agent calls the Salesforce REST API using the user-scoped token, allowing Salesforce to apply sharing rules and return only authorized records. The key principle is that the agent acts as an orchestrator, not a gatekeeper, and doesn't store credentials; instead, each request receives temporary, user-bound access tokens.