How to Govern AI Agent Access with Okta Cross App Access and Amazon Bedrock AgentCore
Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1
- Who
- AWS
- What
- publishes a tutorial a walkthrough for governing AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore
- Quote
In this post, the first of two, you build a task agent on AgentCore runtime that acts for signed-in users through XAA and AgentCore Identity.
What happened
AWS walks through building a task agent that uses Okta Cross App Access and Amazon Bedrock AgentCore Identity to act for signed-in users. The guide shows how to register the agent, pass authorization decisions through a three-token chain, and enforce each user’s permissions in MCP servers. In the authors’ tests, removing a user’s assignment blocked new requests within about 1 second, while issued access tokens lasted up to 5 minutes.
Why it matters
The walkthrough traces how Okta’s per-user authorization decisions pass through AgentCore to MCP tools, with measured revocation timing and failure cases that help teams assess the pattern’s operational tradeoffs.
Read next
See the full storyAWS Shows How to Govern AI Agent Access with Okta and Amazon Bedrock AgentCoreThe story so far
AWS published a tutorial showing how to build a task agent that acts for signed-in users using Okta Cross App Access and Amazon Bedrock AgentCore Identity. The walkthrough passes authorization through a three-token chain and enforces each user’s permissions in MCP servers. In the authors’ tests, removing a user’s assignment blocked new requests within about one second, while already issued access tokens could remain valid for up to five minutes. The setup requires an AWS account with access to AgentCore and an Anthropic Claude model in Amazon Bedrock, plus an Okta organization with Cross App Access for AI agents and API Access Management. AWS says AgentCore charges are based on usage.
Keep up with AI, one email a day
Model releases, price changes and compute developments, with original sources. Free, confirmed by email, and easy to unsubscribe. Read a past issue · 2026-11-06