Amazon Bedrock AgentCore Gateway enables OBO token exchange for multi-tenant AI agents

When deploying generative AI agents in multi-tenant architectures, identity propagation becomes a critical challenge. Without proper handling, downstream APIs either trust the agent unconditionally (creating a confused deputy) or receive an invalid token whose audience doesn't match. Amazon Bedrock AgentCore Gateway now addresses this with native support for OAuth 2.0 Token Exchange (RFC 8693) as a credential-provider grant type. This allows the gateway to exchange the inbound user token for a new one that is cryptographically bound to a single downstream service (via the aud claim) while preserving the original caller's sub claim. The result is cryptographic least privilege: a token issued for one tenant cannot be reused at another.

The implementation guide walks through a complete setup against Okta, showing JWT claim transformations on each hop. The reference application, TravelBot, serves two example tenants (Acme and Globex). Key benefits include identity propagation across tenant boundaries, no agent-side exchange logic (AgentCore performs every exchange transparently), and full compliance with RFC 8693. This pattern is essential whenever an agent fronts multiple downstream services or tenants and the inbound token's audience differs from any single downstream API. For single-tenant agents where audiences already match, direct token forwarding may suffice, but for the multi-tenant case, OBO is the only correct solution.