Implement on-behalf-of token exchange for multi-tenant agents with Amazon Bedrock AgentCore Gateway

This article explains how to implement on-behalf-of (OBO) token exchange for multi-tenant AI agents using Amazon Bedrock AgentCore Gateway, solving the identity problem of preserving user context across tenant boundaries while maintaining cryptographic least privilege.

• AgentCore Gateway transparently exchanges inbound user tokens for audience-bound tokens before invoking downstream tools, eliminating confused deputy vulnerabilities
• The `sub` claim preserves original caller identity end-to-end while `aud` claim binds tokens to specific downstream services, preventing cross-tenant token reuse
• Three-layer defense enforces tenant boundaries at the Gateway target, tenant authorization server, and API Gateway JWT authorizer
• Per-user authorization uses Expression claims (`authorized_scopes`) rather than scope filtering, since token exchange is processed as machine-to-machine
• Data isolation achieved by partitioning DynamoDB on the signed `sub` claim, making it a trustworthy principal for access control
• TravelBot reference implementation demonstrates multi-tenant booking assistant with Okta integration across provider and per-tenant authorization servers
• Common pitfalls include group-based scope capping bypass, DPoP conflicts, `subject_token_type` parameter requirements, and trusted issuer configuration

AgentCore Gateway operationalizes RFC 8693 token exchange without requiring agent-side implementation, enabling consistent audit trails, reduced compromise scope, and tenant onboarding through configuration alone.