{"version":1,"type":"story","url":"https://digestai.news/story/aws-shows-how-to-govern-ai-agent-access-with-okta-and-bedrock-agentcor","json":"https://digestai.news/story/aws-shows-how-to-govern-ai-agent-access-with-okta-and-bedrock-agentcor.json","markdown":"https://digestai.news/story/aws-shows-how-to-govern-ai-agent-access-with-okta-and-bedrock-agentcor.md","slug":"aws-shows-how-to-govern-ai-agent-access-with-okta-and-bedrock-agentcor","headline":"AWS shows how to govern AI agent access with Okta and Bedrock AgentCore Gateway","summary":"AWS published Part 2 of a tutorial on governing AI agent access using Okta Cross App Access (XAA) and Amazon Bedrock AgentCore. The post moves from a small topology—one agent and two Model Context Protocol (MCP) servers—to an enterprise-scale pattern with a single front door: the AgentCore Gateway. The Gateway redeems Okta’s Identity Assertion JWT Authorization Grant (ID-JAG) for each target, while Cedar policies evaluated by AgentCore Policy bind tools to agents and delegated scopes. A second agent running on Amazon EKS joins under its own Okta identity to show the front door works regardless of where an agent runs. AgentCore Observability and CloudWatch Omni collect OpenTelemetry spans from every hop, including Okta’s System Log streamed via EventBridge, so one query joins each ID-JAG grant to the allow or deny decisions it produced. The post also contrasts XAA with per-user OAuth consent for targets like GitHub that don’t accept Okta’s grant, noting revocation behaves differently: XAA stops the next ID-JAG mint and tokens expire in ~5 minutes, while stored consent grants outlive suspension until manually disconnected.","keyPoints":["AgentCore Gateway becomes single front door redeeming Okta ID-JAG for each target with Cedar policies","Second agent on Amazon EKS joins under its own Okta identity proving location-independent governance"],"whyItMatters":"Shows a repeatable, auditable pattern for governing hundreds of agents and thousands of tools across environments, with centralized policy and full traceability—key for regulated industries adopting AI agents at scale.","category":{"slug":"agents","name":"Agents & Tools","url":"https://digestai.news/category/agents"},"entities":{"companies":["AWS","Amazon","Okta","GitHub"],"models":[],"people":[]},"firstPublishedAt":"2026-11-06T17:09:23Z","updatedAt":"2026-11-06T17:09:23Z","sourceCount":1,"hasPrimarySource":true,"sources":[{"outlet":"AWS Machine Learning Blog","title":"Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore","url":"https://aws.amazon.com/blogs/machine-learning/govern-ai-agent-access-with-okta-cross-app-access-and-amazon-bedrock-agentcore-part-2","publishedAt":"2026-11-06T17:09:23Z","type":"primary","primary":true,"lead":true}],"sourceNotes":null,"discussions":[],"thread":{"title":"Amazon Bedrock Enterprise AI Agent Ecosystem Expansion","url":"https://digestai.news/thread/octave-reliance-builds-secure-multi-tenant-ai-foundation-on-amazon-bedrock","storyCount":6},"cite":{"text":"Digest AI, \"AWS shows how to govern AI agent access with Okta and Bedrock AgentCore Gateway\", 6 November 2026, https://digestai.news/story/aws-shows-how-to-govern-ai-agent-access-with-okta-and-bedrock-agentcor","publisher":"Digest AI","title":"AWS shows how to govern AI agent access with Okta and Bedrock AgentCore Gateway","datePublished":"2026-11-06T17:09:23Z","url":"https://digestai.news/story/aws-shows-how-to-govern-ai-agent-access-with-okta-and-bedrock-agentcor"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}