Amazon Bedrock AgentCore Identity enhanced its security features by supporting On-Behalf-Of (OBO) token exchange, allowing agents to exchange user access tokens for scoped tokens to access resources without multiple user consent prompts.
This mechanism reduces friction in multi-resource environments by providing just-in-time, least-privilege access that carries both user and agent identity, streamlining secure agent development and resource access across multiple AWS Regions.
Source & further reading
Amazon Bedrock AgentCore Identity now supports On-Behalf-Of (OBO) token exchange ↗Source published 2026-04-30. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.