Amazon Bedrock AgentCore Gateway: on-behalf-of token exchange for preserving user identity when calling ServiceNow's API
Amazon has published a guide on how to set up on-behalf-of token exchange with Microsoft Entra ID in Amazon Bedrock AgentCore Gateway, so that an AI agent preserves the identity and permissions of the original user when calling ServiceNow's REST API.
AI agents that call enterprise APIs on behalf of users must preserve the identity of that user throughout the entire request chain. Without identity propagation, the API call arrives at the target service as a call from the application itself, not from a specific user, which according to the article violates the audit trail, bypasses user-level access permissions, and violates the principle of least privilege.
Amazon Bedrock AgentCore Gateway, a component of the Amazon Bedrock AgentCore platform for building and running agents, can be configured for on-behalf-of (OBO) token exchange with Microsoft Entra ID. The described flow works as follows: the user obtains a JWT token to invoke the agent, the agent authenticates to the gateway using a token tied to its own application registration, the gateway exchanges this token through the OBO flow for a new token tied to the ServiceNow API connector while preserving the identity of the original user, and ServiceNow, based on the preferred_username claim, maps the request to an existing user and applies that user's permissions.
According to Amazon, this pattern can be combined with the Amazon Bedrock Guardrails tool for filtering malicious content and validating agent inputs and outputs, and it can also be used for other REST APIs protected by the OAuth protocol, not just ServiceNow. The configuration requires changes in three places – application registrations in Microsoft Entra ID, setting up inbound integration and an OIDC provider in ServiceNow, and configuring outbound authorization in AgentCore Gateway. The specific steps of this configuration exceed the scope available from the source; details can be found in the source article.
Why it matters
For companies and developers deploying AI agents connected to enterprise systems such as ServiceNow, the described pattern addresses a specific security problem: otherwise the agent would call the API with its own broad permissions instead of the permissions of a specific user, which complicates auditing and access control. The pattern is transferable to any REST API protected by OAuth, making it a generally applicable technical guide, not just a solution for a single integration.
Two audiences, two different impacts
What this means
For individuals
Developers building AI agents that call enterprise APIs on behalf of users get a concrete configuration procedure for OBO token exchange in AgentCore Gateway, so that the user's identity is not lost when calling the target service.
For a business
Companies deploying AI agents integrated with enterprise systems via AWS Bedrock AgentCore can use this pattern to preserve the audit trail and user permissions during API calls, reducing the risk of violating compliance and security controls compared to a situation where the agent acts as a standalone application without any link to a specific user.
Risks and complianceCheck the original
Event sources
only one source so far · 1 publisher, 0 independent. We count feeds from the same owner only once.