Fine-grained access control for Amazon Bedrock Managed Knowledge Base tools

This post describes an architecture in which all employees share one agent and knowledge base, but each user can search only the documents they are allowed to view, using Amazon Bedrock Managed Knowledge Base ACL awareness exposed as MCP tools through Amazon Bedrock AgentCore Gateway. The design keeps the LLM from deciding who the user is: a request interceptor injects the verified email from the JWT into userContext, Policy in AgentCore checks it against the token's email claim, and a resource-based policy denies searches from principals other than the gateway execution role. It also covers prerequisites, ACL metadata files, tool schema configuration with parameterOverrides, and a verification script that tests each defense.