AWS published a guide to layered authorization for MCP tools in Amazon Quick

AWS published a guide on its Machine Learning Blog to implementing layered (multi-gate) authorization for Model Context Protocol (MCP) tools in Amazon Quick. According to the article, signing in through single sign-on (SSO) and having a valid token confirm only the identity of the caller, not what that user is allowed to do – without granular checks, a single misconfigured token can gain access to tools and data beyond the user's role, complicating compliance audits.

The proposed pattern processes JWT claims from an OpenID Connect (OIDC) token sequentially through four gates: MFA verification, geographic restrictions based on approved countries, group-to-role mapping (role-based access control), and permission checks at the individual tool level. The third and fourth gates (RBAC and tool permission checks) form the core and are always active; the other two can be enabled or disabled as needed through environment variables. The gate logic is executed by an interceptor implemented as an AWS Lambda function connected to Amazon Bedrock AgentCore Gateway, which provides an HTTP endpoint and JWT validation between the client and the MCP tools. The guide uses Microsoft Entra ID as the identity provider, with MFA enforced before the token is issued through a Conditional Access Policy.

The procedure is demonstrated using a fictional example of AnyCompany Global Services, which operates a multi-tenant risk register on Amazon DynamoDB accessible through MCP tools. AWS states that the pattern is particularly relevant to financial services, healthcare, and government, where compliance requires granular access control and an auditable record of every data change.

The available article text is incomplete and ends midway through the description of how the interceptor evaluates the gates. Details can be found in the source article.