OBO Flow for Multi-Tenant Agent Invocations
AWS ML Blog · rss · 2026-07-14
An AWS article explores how to handle identity when generative AI agents invoke downstream APIs on behalf of users in multi-tenant production environments.
It outlines three approaches:
- Calling as the agent itself while spoofing the user via headers: This breaks the audit chain and is a classic confused deputy problem.
- Directly forwarding the user token: Only viable if the downstream audience perfectly matches, which is rarely true in multi-tenant scenarios.
- On-behalf-of (OBO) token exchange: An authorization server exchanges the inbound token for a new one bound to the downstream service's audience, preserving the original user's sub.
The article details the RFC 8693 token exchange mechanism and explains how Amazon Bedrock AgentCore Identity / Gateway automates this exchange at the gateway layer without requiring agent code modifications. It emphasizes that:
- sub represents the impersonated user
- actor / cid represents the agent or delegate performing the exchange
- Audience binding restricts permissions to a specific downstream service
Finally, it provides a reference implementation using TravelBot, leveraging Okta's multiple authorization servers to manage agent inbound tokens and downstream OBO tokens across different tenants, demonstrating a complete multi-tenant identity flow.
More from coding & agent
- Soft Clamp cuts tool-call overuse in multi-teacher distillation, from 13.7% to 9.0% — antgroup · 2026-07-21
- Agent harness memory loss and compaction are still a major usability problem — adityaag · 2026-07-21
- SpecJudge runs locally on Ollama to pick the right-sized AI model for your project — jokiruiz · 2026-07-21
- A developer maps out six design rules for CLIs that humans and AI agents can both use — yujiezha · 2026-07-21
- A coding-agent skill that forces ADHD-friendly, answer-first output — ayghri · 2026-07-21
- A set of agent skills for CAD, robotics, and hardware design — earthtojake · 2026-07-21