Propagate user authorization context in AI agents with Amazon Bedrock AgentCore

This article demonstrates how to propagate user authorization context through Amazon Bedrock AgentCore to enforce least-privilege access across multiple data sources without embedding authorization logic in agent code.

• Use Amazon Cognito pre-token generation Lambda triggers to enrich JWTs with custom department claims and AWS session tags
• Validate inbound requests with AgentCore Runtime's JWT authorizer before agent code executes
• Scope DynamoDB access using AssumeRoleWithWebIdentity with session tags and IAM attribute-based access control (ABAC)
• Apply metadata filtering to Amazon Bedrock Knowledge Bases queries based on user department attributes
• Exchange user identity for service-scoped tokens using RFC 8693 on-behalf-of token exchange with external services like Salesforce
• Move authorization enforcement from agent code to infrastructure-level controls and downstream service policies

This architecture ensures agents act as orchestrators rather than gatekeepers, with access decisions enforced by infrastructure and downstream services regardless of agent compromise or prompt injection attacks.