AWS tutorial demonstrates governing multi-agent access with AgentCore Gateway
Understand this story
The AWS Machine Learning Blog published two tutorials demonstrating how to use Okta Cross App Access (XAA) and Amazon Bedrock AgentCore to control which user an AI agent acts on behalf of and in which application. The first takes about 1 hour and builds a task agent on AgentCore runtime that performs actions on behalf of a signed-in user via XAA and AgentCore Identity. The second builds on the first approach and takes about another 90 minutes, setting AgentCore Gateway as the sole entry point, redeeming Okta authorization for each target, and having AgentCore Policy evaluate default-deny Cedar policies before tool execution. Both tutorials state that the code is sample code not intended for production use and that security and legal teams must confirm compliance requirements before deployment; AgentCore is billed by usage, and the second tutorial also involves the EKS control plane at $0.10 per hour plus node and EKS Auto Mode management fees.
AI overview based on source reports · Updated 16 min ago
Developments
2 developments
- Nov 7 01:09 · 1 reportsIntroducing governing multi-agent access with AgentCore GatewayAWS Machine Learning Blog：Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 2
- Nov 7 01:09 · 1 reportsIntroducing governing agent access with Okta XAA and AgentCoreAWS Machine Learning Blog：Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1
Coverage timeline
Follow the coverage to explore different perspectives.
- AWS Machine Learning BlogGovern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 2
Part 2 of this AWS post moves the Part 1 Okta Cross App Access solution from one agent and two MCP servers to a topology with Amazon Bedrock AgentCore Gateway as a single front door that redeems Okta's ID-JAG for each target, default-deny Cedar policies in AgentCore Policy binding tools to agents and delegated scopes, and a second agent on Amazon EKS under its own Okta identity. It also describes tracing decisions with AgentCore Observability and CloudWatch Omni alongside Okta's System Log, reports validation results and latency figures, and compares XAA with per-user OAuth consent for applications that cannot accept an ID-JAG.
- AWS Machine Learning BlogGovern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1
This AWS post describes using Okta Cross App Access (XAA) as the governance plane and Amazon Bedrock AgentCore Identity as the execution plane so an AI agent can act on behalf of signed-in users, with Okta deciding which agent may act for which user and AgentCore redeeming Okta's single-use ID-JAG for a short-lived access token. It walks through registering the agent in Okta, configuring the credential provider and workload identity, enforcing per-user authority via the groups claim in MCP servers, and reports measured results such as revocation taking effect in about 1 second and AgentCore Identity adding about 0.6 seconds to a roughly 30-second request.
Activity for this story
Not enough continuous observations to show a trend yet.