Amazon Bedrock AgentCore Identity now supports On-Behalf-Of (OBO) token exchange
Agents can now securely access downstream resources on behalf of users without requiring separate permission flows for each resource.
View original announcement →Visual Summary
graph TD
A{{AgentCore Identity OBO Exchange}}:::announced
B((End User)):::external
C(Amazon Bedrock AgentCore):::compute
D([User Access Token]):::feature
E([Scoped OBO Token]):::feature
F((Protected Resource)):::external
G([Least-Privilege Access]):::feature
H(AI Agent):::compute
I([Identity Chain Audit]):::feature
B ==>|"authenticates"| D
D ==>|"presented by"| H
H ==>|"requests exchange"| A
A -->|"validates & issues"| E
E -->|"carries user + agent"| G
E ==>|"grants access"| F
A -->|"orchestrated within"| C
A -.->|"enables"| I
I -.->|"traces back to"| B
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
Amazon Bedrock AgentCore Identity now supports On-Behalf-Of (OBO) token exchange, a generally available capability that enables AI agents to securely access protected downstream resources while preserving the identity of the authenticated end user. Developers can exchange an existing access token for a new, scoped-down token that carries both the original user identity and the agent identity, targeted specifically to the outbound resource being accessed. This eliminates the need for users to complete separate consent flows for each protected resource an agent needs to interact with.
How It Works
- OBO token exchange follows a delegated authorization pattern rooted in OAuth 2.0 token exchange semantics (RFC 8693).
- When an authenticated user initiates an agent workflow, the agent receives the user's access token and presents it to Amazon Bedrock AgentCore Identity along with a request for a new token scoped to a specific downstream protected resource.
- AgentCore Identity validates the incoming token, verifies the agent's identity, and issues a new access token that encodes both the original user principal and the agent principal.
- This derived token is narrowly scoped — granting just-in-time, least-privilege access — and is targeted exclusively to the intended outbound resource, meaning it cannot be reused across other services.
- The process is transparent to the end user and requires no additional consent prompts after the initial authorization.
Why It's Important
- This capability is significant because it directly addresses one of the most common friction points in agentic AI architectures: managing delegated authorization across multiple protected resources without degrading the user experience.
- In enterprise and consumer applications where agents must orchestrate calls to APIs, databases, or SaaS services on a user's behalf, the traditional approach of triggering separate OAuth consent flows per resource creates both UX friction and security surface area.
- OBO token exchange centralizes and automates this delegation, enabling developers to build more capable, multi-step agents while adhering to least-privilege security principles.
- It also ensures auditability, since the derived token carries the full identity chain (user + agent), making it possible to trace actions back to both the originating user and the acting agent.
How It's Different
- Previously, developers building agents on AWS that needed to act on behalf of users had to manually orchestrate separate consent flows for each protected resource, often relying on custom token management logic, stored refresh tokens, or workarounds that either over-provisioned permissions or required repeated user interaction.
- There was no native, platform-managed mechanism within Bedrock to perform delegated token exchange that preserved user identity across the agent's downstream calls.
- OBO token exchange replaces these ad hoc approaches with a standardized, platform-enforced delegation model.
- Compared to service-to-service IAM role assumption (which carries only the agent/service identity and loses the user context), OBO tokens maintain the full identity chain, which is critical for user-scoped authorization policies and audit logging in downstream systems.
When to Prefer It
- OBO token exchange is the right choice whenever an AI agent must access user-owned or user-scoped protected resources — such as a user's calendar, email, CRM records, or personal cloud storage — where the downstream system enforces user-level authorization policies.
- It is particularly well-suited for enterprise agentic workflows that span multiple APIs or microservices, where re-prompting users for consent at each step would be impractical.
- Prefer OBO over static service credentials or broad IAM roles when auditability of user-level actions is required, when downstream systems enforce per-user access controls, or when compliance requirements mandate that delegated actions be traceable to the originating human identity.
- It is less appropriate for purely system-to-system workflows where no human user context exists, in which case standard IAM role-based access remains the better fit.
Availability
- Amazon Bedrock AgentCore Identity OBO token exchange is generally available (GA) as of April 30, 2026.
- It is supported across 14 AWS Regions: US East (N.
- Virginia), US East (Ohio), US West (Oregon), Canada (Central), Asia Pacific (Mumbai), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), and Europe (Stockholm).
- No preview or limited-access restrictions are noted in the announcement.
- Specific service quotas, supported identity provider integrations, and any token lifetime or scope limitations are not detailed in the announcement and should be reviewed in the Amazon Bedrock AgentCore Identity documentation before production adoption.
