The AWS Machine Learning Blog has published an implementation guide for setting up on-behalf-of (OBO) token exchange in multi-tenant agents using Amazon Bedrock AgentCore Gateway. Building on prior posts that covered the conceptual foundation for multi-tenant agents and fine-grained access control via Gateway interceptors, this article focuses on hands-on implementation.
The guide walks through a complete multi-tenant OBO setup against Okta, illustrates the JSON Web Token (JWT) claim transformations that occur at each hop, and demonstrates how audience binding contributes to a defense-in-depth approach designed to scale across tenants.
Why it matters
Securely propagating user identity through agentic systems is a core requirement for multi-tenant deployments. The post addresses this with a concrete configuration involving token exchange, claim transformation, and audience binding.
Who should care
Developers and architects working on multi-tenant agents with Amazon Bedrock AgentCore, particularly those integrating identity providers such as Okta, are the primary audience.