Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 2

Part 2 of this AWS post moves the Part 1 Okta Cross App Access solution from one agent and two MCP servers to a topology with Amazon Bedrock AgentCore Gateway as a single front door that redeems Okta's ID-JAG for each target, default-deny Cedar policies in AgentCore Policy binding tools to agents and delegated scopes, and a second agent on Amazon EKS under its own Okta identity. It also describes tracing decisions with AgentCore Observability and CloudWatch Omni alongside Okta's System Log, reports validation results and latency figures, and compares XAA with per-user OAuth consent for applications that cannot accept an ID-JAG.