ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway

This post explains how to configure Amazon Bedrock AgentCore Gateway for an on-behalf-of (OBO) token exchange with Microsoft Entra ID so an AI agent can call the ServiceNow REST API while preserving the calling user's identity. It covers creating Entra application registrations for the agent and a ServiceNow API connector, configuring a ServiceNow inbound OAuth integration with an OIDC provider, and setting up the gateway with MCP version 2025-11-25, an outbound OAuth client using the JWT authorization grant, and a target with the token exchange grant (scope plus requested_token_use: on_behalf_of). The post states that native OBO support removes the need for custom AWS Lambda interceptors to perform token exchanges.