Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1

This AWS post describes using Okta Cross App Access (XAA) as the governance plane and Amazon Bedrock AgentCore Identity as the execution plane so an AI agent can act on behalf of signed-in users, with Okta deciding which agent may act for which user and AgentCore redeeming Okta's single-use ID-JAG for a short-lived access token. It walks through registering the agent in Okta, configuring the credential provider and workload identity, enforcing per-user authority via the groups claim in MCP servers, and reports measured results such as revocation taking effect in about 1 second and AgentCore Identity adding about 0.6 seconds to a roughly 30-second request.