This AWS Machine Learning Blog post is the second installment in a series on governing AI agent access. Where Part 1 covered building a single governed agent, Part 2 extends the approach to an enterprise scale. In this configuration, Amazon Bedrock AgentCore Gateway acts as the single entry point and redeems a grant issued by Okta. Cedar policies are used to bind each tool to its corresponding agent, and a second agent is deployed on Amazon EKS. AgentCore Observability records each allow and deny decision, placing those traces alongside Okta’s logs within Amazon CloudWatch.
Why it matters
As organizations deploy multiple AI agents, controlling and auditing which tools each agent can access becomes a practical concern. The described pattern combines identity governance, policy-based authorization, and centralized observability to manage access across more than one agent.
Who should care
Enterprise teams building or operating AI agents on AWS, along with identity and platform engineers responsible for access governance and auditing, are the primary audience for this walkthrough.