Amazon Bedrock AgentCore Identity now supports On-Behalf-Of (OBO) token exchange, enabling developers to build agents that securely access protected resources on behalf of authenticated users — without requiring users to complete multiple consent flows.
Previously, developers building agents that needed to act on behalf of a user had to manage separate consent flows for each protected resource, adding friction for end users and complexity for builders. With OBO token exchange, developers can exchange an access token for a new scoped-down access token that carries both the original user identity and the agent identity. This token is targeted specifically to the outbound protected resource, granting just-in-time, least-privilege access without prompting the user for additional consent.
Amazon Bedrock AgentCore Identity OBO token exchange is now generally available in 14 AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Asia Pacific (Mumbai), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), and Europe (Stockholm). To learn more, visit the Amazon Bedrock AgentCore Identity documentation .
Categories: general:products/amazon-bedrock
Source: Amazon Web Services
Latest Posts
- MC1477184: Microsoft 365 admin center consolidates duplicate Agent Registry entries and adds version history
- MC1446796: Exchange Online Replaces EWS-Based Free/Busy, MailTips, and Calendar Sharing with Microsoft 365 Cross-Tenant Access Policy
- AWS Systems Manager now supports sharing documents through AWS Resource Access Manager
- MC1454397: Exchange Online Updates Tenant External Recipient Rate Limit Quotas for New, Trial, and Education Tenants
