Implement on-behalf-of token exchange for multi-tenant agents with Amazon Bedrock AgentCore Gateway

Building multi-tenant agents with Amazon Bedrock AgentCore and Apply fine-grained access control with Bedrock AgentCore Gateway interceptors establish the conceptual foundation for on-behalf-of (OBO) token exchange in agentic systems. This post is the implementation guide. It walks through a complete multi-tenant OBO setup against Okta, shows the JSON Web Token (JWT) claim transformations on each hop, and demonstrates how audience binding produces defense in depth that scales across tenants.

Related

• Extending MCP support for Amazon Bedrock AgentCore Gateway
• Configuring Amazon Bedrock AgentCore Gateway for secure access to private resources

Source: AWS ML Blog | 2026-07-13