AWS sets up an on-behalf-of token exchange in Bedrock AgentCore Gateway so an agent calls ServiceNow as the signed-in user
A worked pattern for keeping the user's identity, audit trail and permissions intact when an agent calls enterprise APIs.
// Key points
- Without identity propagation, agent calls reach downstream services as the application rather than the user, which breaks audit trails and bypasses user-level access controls
- The agent authenticates to the gateway with a JWT scoped to its own Microsoft Entra ID app registration; the gateway exchanges it through the OBO flow for a token scoped to the ServiceNow connector, with the user's identity preserved
- ServiceNow maps the token's preferred_username claim to an existing user and applies that user's permissions; the exchange is configured on the gateway target and runs on each request
- AWS says the pattern applies to other REST APIs protected by OAuth
Builder's takeThis should be the default for any agent that touches business systems: the agent acts as the user, not as a super-account. For AI Cloud Drive's agent features I'd do the same, exchanging the user's token at the tool gateway and letting the storage layer enforce its own permissions, rather than filtering results inside the agent.
// Background · from #AI agents
Full timeline →- Nov 4 Claude's Messages API adds message threads in beta: later turns send only the new messages, and a thread expires 5 minutes after its last request
- Nov 4 Google DeepMind releases Cheminformatics Skills for Antigravity: in a lung-cancer drug case, an agent curates thousands of compounds and proposes macrocycles with synthetic routes in an hour
- Nov 4 Ai2's StateBench: Gemini 3.8 Flash, Claude Opus 5.5 and GPT-6 Sol and Luna drop to 13% or lower on the longest, hardest state-tracking problems