AWS shows fine-grained access control for agentic RAG on Bedrock knowledge bases
AWS ML Blog · rss · 2026-11-12
AWS ML Blog demonstrates how to let users sharing one agent and knowledge base search only documents they're authorized to see.
Core problem: In agent apps, the LLM decides at runtime which tool to call and with which arguments. If "search as whom" becomes an LLM-constructed argument, prompt injection or model error could leak other users' data — critical for multi-tenant SaaS.
Solution highlights
- Principle: never let the LLM decide who the user is; trusted code derives identity from verified token claims.
- Bedrock Managed Knowledge Base's ACL awareness returns only chunks the userContext user can view.
- Bedrock AgentCore Gateway exposes the KB as MCP tools; a Lambda request interceptor overwrites the userContext argument from the validated JWT.
- Two secondary defenses: Policy in AgentCore (Cedar) denies requests where userContext doesn't match the JWT email claim, and a knowledge-base resource policy allows only the gateway's execution role.
Deployable as a single CDK stack; the Strands agent defaults to Claude Sonnet 5.5.
More from coding & agent
- Granola launches MCP 2.0 with Smart Search cutting token use by 85% — soleio · 2026-11-13
- Epic MegaJam: 5 humans, unlimited AI agents, $65K prizes in 4-day Unreal game jam — PtrPomorski · 2026-11-13
- Same model's tool-call error rate varies 15× across inference providers, dottxt index finds — remilouf · 2026-11-13
- AI Has Made Framework Switching Costs Lower Than Ever, Argues Frameworks Author — Vjeux · 2026-11-13
- NetBird routing peer lets you reach uncliented servers securely without opening ports — philipvollet · 2026-11-13
- Gemini's new Decision API tested: AI auto-orchestrates UI decision paths — huangyun_122 · 2026-11-13