Briefs

BriefsToolAvailable now1 min read

Amazon Bedrock AgentCore adds on-behalf-of token exchange for ServiceNow

Amazon Bedrock AgentCore now supports on-behalf-of token exchange, allowing AI agents to maintain user identity when calling ServiceNow APIs.

Amazon Bedrock AgentCore adds on-behalf-of token exchange for ServiceNow — image from AWS
Image: AWS

Summary

Amazon Bedrock AgentCore Gateway now enables on-behalf-of token exchange with Microsoft Entra ID. This allows AI agents to call ServiceNow REST APIs while preserving the identity of the user who initiated the request. This update removes the requirement for custom AWS Lambda interceptors to manage token exchanges.

What changed

  • Added native on-behalf-of token exchange support to AgentCore Gateway.
  • Enabled identity propagation for AI agents calling ServiceNow REST APIs.
  • Introduced support for JWT authorization grants in outbound auth configurations.
  • Required MCP version 2025-11-25 for native on-behalf-of token exchange support.

Availability

Available now

“This post shows how to configure AgentCore Gateway , a capability of Amazon Bedrock AgentCore, for an on-behalf-of (OBO) token exchange with Microsoft Entra ID.”

Founder takeaway

If you are building AI agents that interact with ServiceNow, use the new native on-behalf-of token exchange in AgentCore Gateway to maintain user identity and access controls without writing custom code.

Source

AWSServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway | Amazon Web Services

Announced Checked

Researched and drafted with AI from the official sources above, then checked automatically before publishing. Spotted a mistake? Tell us.

SharePost on XLinkedIn

Related

More briefs

All briefs
  1. Collinear AI releases CWE-bench v2 to test AI cyber capabilities — image from Hugging Face

    ToolAvailable now

    Collinear AI releases CWE-bench v2 to test AI cyber capabilities

    Collinear AI released CWE-bench v2, an AI benchmark featuring 100 tasks across 91 vulnerability classes to test cyber capabilities.

    Hugging Face1 min read

  2. Supabase adds Claude-issued identity assertions for MCP auth — image from Supabase

    ToolRolling out

    Supabase adds Claude-issued identity assertions for MCP auth

    Supabase adds support for Claude to issue signed identity assertions for Model Context Protocol authentication when identity providers lack extension support.

    Supabase1 min read

  3. Gen Digital built the Norton Revamp AI news engine using Amazon Bedrock AgentCore Web Search — image from AWS

    ToolAvailable now

    Gen Digital built the Norton Revamp AI news engine using Amazon Bedrock AgentCore Web Search

    Gen Digital details how its small engineering team built Norton Revamp, an AI-powered professional reputation platform using Amazon Bedrock AgentCore Web Search.

    AWS1 min read

One email, every Monday

Briefs are published here through the day. Monday Heist is the email: one useful AI workflow, the files to use it, and the catch. The first issue is being prepared; subscribers get it first. Free, and you can leave in one click.

One email. Every Monday.