Authentic Authorization and Audit for Agentic AI on AWS

Jeff Lombardo of Amazon Web Services demonstrated how AgentCore handles authentication, authorization, and audit for agentic AI. Using a fictional retail company, the session walked through AgentCore Runtime, Gateway, Identity, and Policy, covering JWT-based access to agents, credential translation for legacy systems, delegated OAuth flows, and fine-grained policy enforcement built on the open source Cedar language. Presenting at Security Field Day 16, Lombardo framed agent identity around delegation under human control, strong agent identity, dynamic permissions, and just-in-time issuance and revocation.

Lombardo showed Runtime gating agents with JWTs constrained by client ID or claims, then using each token’s issuer and subject to mark the agent’s own credential so that one user’s agent instance can only reach resources tagged for that user. Gateway exposes tools as MCP endpoints from existing MCP servers, Lambda functions, REST APIs described by an OpenAPI document, or prebuilt connectors for services like Salesforce, BambooHR, Confluence, and DynamoDB. It accepts short-lived OAuth tokens inbound and translates them into the static API keys legacy systems still require. Request and response hooks let teams enrich calls or redact data before it reaches the LLM, which Lombardo warned will try to weaponize whatever the agent learns. Identity stores only references to credentials, including secrets held in 1Password or HashiCorp Vault, so gateway builders never see the secrets themselves, and Gateway supports MCP URL elicitation for user consent.

The policy layer is where the platform becomes truly dynamic. Cedar evaluates principal, action, resource, and context with default deny and overriding forbid rules, and Lombardo stressed that its decisions are mathematically provable even across a million policies. AgentCore Policy runs Cedar as a managed service, generates the schema automatically from a gateway’s tool list, and translates natural language into policy, such as limiting managers to listing products twice per hour. That example relies on Dogwood, a newly released open source temporal extension that conditions access on prior actions, like requiring items in a basket before payment. Because policies are exposed through APIs, observability alarms can drive new restrictions in near real time, turning audit signals directly into tighter agent controls.