AWS adds native on-behalf-of token exchange to AgentCore Gateway for ServiceNow
AWS published a walkthrough showing how to configure Amazon Bedrock AgentCore Gateway to perform on-behalf-of (OBO) token exchanges with Microsoft Entra ID so that AI agents can call the ServiceNow REST API while preserving the original user's identity. The pattern uses two Entra application registrations — one for the agent and one for the ServiceNow API connector — and requires MCP version…
Key points
- AgentCore Gateway now performs OBO token exchange natively with Microsoft Entra ID
- Requires MCP version 2025-11-25 and two Entra app registrations
- Preserves user identity when agents call ServiceNow REST API
The story so far
5 episodes →- AWS adds native on-behalf-of token exchange to AgentCore Gateway for ServiceNowthis story
ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway
AWS Machine Learning Blog · 3 November 2026
Loading the full article…
This text was published by AWS Machine Learning Blog and written by Greg Biegel. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- Apple enables Siri AI actions in third-party apps via iOS 27.3 · 1 src
- Apple opens Siri AI to developers via iOS 27.3 betas · 1 src
- Workday launches headless AI agent platform for small businesses · 1 src
- Google adds Cheminformatics Skills to Antigravity for chemistry workflow · 1 src
- Ontologies help AI agents understand business rules and relationships · 1 src
Comments
via GitHub Discussions