Okta outlines user identity handoff for Amazon Bedrock AgentCore tool calls

Okta describes an approach to keep a user's identity associated with calls made by agents running on Amazon Bedrock AgentCore. The company characterizes AgentCore as a platform for building, deploying and operating AI agents, and says it works with any framework and foundation model. Its services span runtime, memory, tool connectivity, identity, policy and observability, according to Okta. The company says the platform can help teams move agents into production without managing infrastructure.

The identity issue, in Okta's account, is a difference between authenticating a person when an agent starts and identifying that person when the agent reaches an external tool. AgentCore can accept a JSON Web Token issued by an OpenID Connect identity provider and be configured to validate a user's Okta token. But Okta says outbound requests default to the agent's own principal rather than carrying the incoming user's authority. As a result, the identity used to begin an agent session may not be the identity represented in the agent's later tool requests.

Okta proposes combining Cross-App Access, or XAA, with the Identity Assertion Authorization Grant, or ID-JAG, to address this handoff. In the described flow, the user's OIDC token is exchanged for a short-lived OAuth 2.0 access token with a defined scope. Okta says that token includes both user attribution and the agent's identity as the request moves between tools. The company presents the approach as one for agents operating across multiple trust domains. A token associated with a specific target resource and user attribution is different from simply passing along an incoming credential, the source explains.

The setup also has an implementation boundary for builders: AgentCore Runtime passes an invocation payload to the agent's entry point, but does not carry out the Okta token exchange. Okta says performing that exchange is the application code's responsibility. Its description also says AgentCore validates inbound authentication, while deliberate delegation is needed for outbound calls to carry a user's authority. For AI builders, that distinction matters when determining whether a downstream request reflects the user who initiated work or only the agent's own principal. The source explains the identity handoff, but the excerpt does not provide further implementation steps.