AWS Adds ServiceNow Token Exchange for Bedrock AgentCore

What Happened

AWS published implementation guidance for on-behalf-of (OBO) token exchange between ServiceNow and Amazon Bedrock AgentCore Gateway, enabling agents to act under delegated user identity rather than a shared service identity. The documented flow uses OAuth 2.0 token exchange (RFC 8693) to swap a ServiceNow-issued user token for a scoped token that AgentCore Gateway accepts, with the agent's actions attributed to the originating user across the call chain. The integration is documented on the AWS Machine Learning Blog as a reference architecture, not a turnkey managed feature.

Why It Matters

Delegated identity has been the gating item between agent pilots and production deployment in regulated enterprises. Most agent implementations to date run under a static service account or a broad-scoped role, which collapses audit trails, violates least-privilege controls, and fails security review at the point where a human needs to be named as the principal. OBO token exchange resolves this by preserving the user's identity through the agent hop, making authorization decisions enforceable at each downstream service while keeping the audit record attributable to a person. For ServiceNow customers specifically — a large installed base with mature identity governance — this closes the gap between ITSM-managed entitlements and LLM-driven automation. The beneficiary is the platform team that has been blocked from shipping agent workflows into production by IAM and compliance reviewers rather than by model capability.

Technical Details

The architecture chains three trust boundaries: ServiceNow as the identity provider issuing the initial user assertion, AgentCore Gateway as the token exchange broker and policy enforcement point, and the downstream target resource that validates the exchanged token. RFC 8693 token exchange defines the request format — the agent presents the user's subject token and requests a token scoped to the target audience, and the authorization server returns an access token with narrowed scope and a shortened lifetime. AgentCore Gateway's role is to perform the exchange, attach the inbound auth configuration, and enforce per-tool authorization before the agent invokes the target. The pattern requires the ServiceNow instance to expose a token endpoint compatible with the exchange grant, and each target must accept the resulting audience-scoped token. The documentation covers the reference implementation but leaves per-environment configuration — trust policy, claim mapping, scope definition — as operator work.

Operational Impact

Builders gain a repeatable identity pattern they can template across agent deployments instead of hand-rolling credential management per integration. The immediate workflow change: agent definitions move from embedding a service credential to declaring an inbound auth provider and a token exchange target, and authorization logic shifts from agent code into Gateway policy. Security review cycles shorten because the reviewer can trace a single user action through the exchange to the downstream call, rather than reasoning about a shared principal's blast radius. Operational cost moves toward identity administration — scope catalogs, token lifetime policy, claim mapping maintenance — and away from per-integration secret rotation. Existing agents running on static credentials become candidates for migration, and the migration is a config change plus a scope audit, not a rewrite.