AWS adds AgentCore Gateway with Cedar policies to scale Okta agent governance
AWS ML Blog · rss · 2026-11-07
Part 2 of AWS's Okta Cross App Access series scales the single-agent setup to enterprise grade: Amazon Bedrock AgentCore Gateway becomes the single front door that redeems Okta grants, replacing the N-agent × M-server wiring matrix.
Key changes
- Agents hit one Gateway endpoint; the Gateway holds the target registry
- Agent roles lose token-exchange permissions and secret access; the Gateway redeems grants
- Per-server groups checks become one default-deny Cedar policy set evaluated at the Gateway before each tool call
- A second agent on Amazon EKS joins under its own Okta identity, proving location independence
- Full OpenTelemetry spans flow to AgentCore Observability + CloudWatch, with Okta System Log streamed via EventBridge for unified audit
Gotchas: targets need static tool schemas (Cedar policies can't attach to dynamically listed tools); clients must follow tools/list pagination; a single-use ID-JAG serves all tool calls in a session within its 5-minute life; give each agent its own Gateway and credential provider. Buildable in 90 minutes on the public sample 08-okta-xaa-delegation-chain.
More from coding & agent
- Developer rebuilds hospital notes as one document with a version-history timeline — BraydonDymm · 2026-11-07
- Aside launches Computer Use agent: 2.7x faster than Codex with 65% fewer tokens — ycombinator · 2026-11-07
- Regression testing with AI coding: fixing one thing quietly breaks another — _ACTUALin · 2026-11-07
- Together AI's TKCC lets agents hot-patch inference engines: 252x more experiments, 2.6x throughput — simran_s_arora · 2026-11-07
- Every's Slack cloned with 51 AI coworkers built from team messages — every · 2026-11-07
- New MCP Agent Usability leaderboard ranks how well coding agents use MCP servers — alejxb · 2026-11-07