AWS Explains AI Agent Access Governance Using Okta Cross App Access and Bedrock AgentCore

AWS published a technical guide detailing how to govern AI agent permissions across applications using Okta Cross App Access (XAA) alongside Amazon Bedrock AgentCore. The architecture divides responsibilities between an Okta governance plane and an AWS execution plane. Okta determines whether a registered agent is permitted to act on behalf of a specific user against a custom resource, enforcing scope restrictions and group memberships. On the execution side, Bedrock AgentCore runtime executes agent logic while AgentCore Identity manages credentials and exchanges tokens without exposing client secrets to application code. The protocol utilizes a three-token chain comprising a user ID token, an Okta-issued Identity Assertion JWT Authorization Grant (ID-JAG), and a short-lived 5-minute access token used when calling Model Context Protocol (MCP) servers. According to AWS benchmark tests, when an administrator removed a user assignment, Okta refused subsequent agent requests for that user within approximately 1 second, while AgentCore Identity introduced around 0.6 seconds of processing time on an end-to-end 30-second request.

Key takeaways

• Okta XAA acts as the governance plane, validating user assignment, agent status, and approved custom scopes before issuing a 5-minute ID-JAG token.
• Bedrock AgentCore Identity serves as the execution plane, using a credential provider to redeem the ID-JAG for an access token without exposing client secrets to agent code.
• The access token carries user group claims (such as xaa-*), allowing downstream Model Context Protocol (MCP) servers to enforce tool-level authorization.
• AWS reported test measurements where policy revocations halted new requests within about 1 second, and identity exchange added roughly 0.6 seconds to a 30-second request.