ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway
Summary
- Amazon Bedrock AgentCore Gateway now supports native on-behalf-of (OBO) token exchange with Microsoft Entra ID.
- This capability allows AI agents to interact with downstream enterprise APIs, like ServiceNow, while preserving the original calling user's identity and permissions.
- The architecture uses an OBO token flow where the gateway exchanges the agent's inbound JWT token for a target-scoped token via Entra ID.
- Proper setup requires configuring application registrations in Microsoft Entra ID, an inbound OAuth integration in ServiceNow, and outbound auth settings in AgentCore Gateway.
Why it matters
Maintaining user identity propagation for AI agents interacting with enterprise systems is critical for security compliance, precise audit trails, and adhering to the principle of least privilege.