Implement on-behalf-of token exchange for multi-tenant agents with Amazon Bedrock AgentCore Gateway
AWS Dhawalkumar Patel
AWS shows how Bedrock AgentCore now handles token swaps so AI agents calling APIs for different customers don't mix up who's who. Without this, one leaked agent token could act as any user across any client — a real security mess.
Based on reporting by AWS, Dhawalkumar Patel — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Multi-tenant AI agents have a plumbing problem nobody likes to talk about: when your agent calls a booking API or a CRM on behalf of a user, whose credentials actually make that call? AWS just published a detailed implementation guide showing how Amazon Bedrock AgentCore Gateway solves this using something called OAuth 2.0 Token Exchange, RFC 8693 if you want to look it up, and the write-up is refreshingly specific about the mechanics rather than just waving at the concept.
The core issue is what security folks call the confused deputy problem. If an agent authenticates as itself and just asserts "this request is for user X" via a header, every downstream service has to trust the agent completely. Steal that agent's credentials and you can impersonate anyone, at any tenant. The other bad option, forwarding the user's original token unchanged, only works if that token's audience already matches the downstream API, which almost never holds true once an agent is fronting multiple tenants or acting as a gateway to several tools. AWS built a reference implementation called TravelBot, a booking assistant serving two fictional tenants, Acme and Globex, to walk through the fix.
The fix is token exchange done at the Gateway layer, automatically. AgentCore Identity holds delegate credentials and swaps the inbound user token for a new one scoped to exactly one downstream service, before the tool call ever fires. The user's identity, their sub claim, rides along unchanged from start to finish, so audit logs still resolve to the real person. But the audience claim gets rewritten per hop, and scopes get trimmed to the minimum needed, so a token issued for Acme's travel API literally cannot be replayed against Globex's. A separate actor claim records that AgentCore performed the delegation, which is handy for rate-limiting and forensics without confusing it with actual authorization logic.
What's notable is how AWS designed this to avoid vendor lock-in on the identity provider side. The TravelBot demo runs entirely on Okta's custom authorization servers, three of them, one per tenant plus one for the agent itself. But the exact request shape AgentCore sends is configurable per credential provider, so Auth0's Custom Token Exchange and Keycloak's realm-level token exchange feature should plug in with config changes, not code rewrites. Microsoft Entra ID uses a slightly different flavor of on-behalf-of built on RFC 7523 rather than RFC 8693, and AgentCore Identity apparently supports that too, as a separate grant type. AWS is explicit that this is architecture-layer stuff, sitting at the authorization server, so it's meant to generalize.
The piece also spells out defense in depth in a way that feels earned rather than boilerplate. Even after the Gateway does its exchange correctly, each tenant's API Gateway runs its own JWT authorizer checking issuer, audience and scopes independently, and the Lambda behind it partitions data storage by the user's sub claim as a last backstop. That's three separate checkpoints before a single downstream request succeeds, which is the kind of redundancy you actually want when the cost of a mistake is one customer's data leaking into another's booking history.
My take — AI-written commentary, not fact-checked reporting
This is the boring, correct kind of AI infrastructure work that doesn't get headlines but actually determines whether agentic systems survive contact with real enterprises. Everyone's racing to ship agents that call tools; almost nobody was asking who's actually authenticated on the other end of that call, and AWS just made the answer a config setting instead of a custom security nightmare every team reinvents badly. I'd rather see ten more posts like this than another benchmark leaderboard.
Read more about this at: AWS