Security & Threat Intelligence · 19.08.2026, 17:31 UTC
Propagate user authorization context in AI agents with Amazon Bedrock AgentCore
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | AWS Security Blog ↗ |
| Veröffentlicht | 19.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
Many teams now deploy AI agents that pull from Amazon DynamoDB tables, document repositories, software as a service (SaaS) platforms, and internal knowledge bases to answer questions and automate workflows. A key risk in these deployments is that the agent has no awareness of who’s asking, so it might return data the user shouldn’t see. If you’re using Amazon Bedrock AgentCore to build AI agents that access multiple data sources, you need each user to see only the data they’re authorized to access. In this post, you learn patterns for propagating user authorization context through your agents so access control is enforced by infrastructure and downstream services, not by agent code. In this post, we show you how to deploy agents that enforce least privilege access without writing authorization logic in the agent itself. This approach follows AGENTSEC03 best practice in the AWS Well-Architected Agentic AI Lens. Use case Consider an example of a customer relationship management (CRM) chat application where employees from Sales and Finance departments interact with an AI agent to access customer information. Employees use the same chat interface and the same agent, but each department needs isolated access to their respective data: Sales needs access to customer contracts, pricing strategies, and sales pipeline data Finance needs access to customer invoices, payment records, and financial reports The AI agent accesses three types of data sources on behalf of users: Customer records in Amazon DynamoDB, partitioned by department Department-specific …