Implement on-behalf-of token exchange for multi-tenant agents with Amazon Bedrock AgentCore Gateway
AWS Machine Learning Dhawalkumar Patel
Amazon Bedrock AgentCore Gateway now supports OAuth 2.0 Token Exchange (RFC 8693) to enable secure on-behalf-of token exchange in multi-tenant AI agent architectures, allowing agents to call downstream APIs with tokens bound to specific users and tenants rather than the agent's service identity. The reference implementation demonstrates the pattern using TravelBot, a multi-tenant booking assistant serving two example tenants (Acme and Globex) with token exchanges orchestrated transparently by AgentCore without requiring agent-side exchange logic. This approach preserves user identity end-to-end through the sub claim while cryptographically scoping each downstream call to a single service through the aud claim, preventing confused deputy vulnerabilities and enabling independent token validation by downstream APIs.
Why it matters
Building multi-tenant agents with Amazon Bedrock AgentCore and Apply fine-grained access control with Bedrock AgentCore Gateway interceptors establish the conceptual foundation for on-behalf-of (OBO) token exchange in agentic systems. This post is the implementation guide. It walks through a complete multi-tenant OBO setup against Okta, shows the JSON Web Token (JWT) claim transformations on each hop, and demonstrates how audience binding produces defense in depth that scales across tenants.
