ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway

Amazon's guide shows how to configure Bedrock AgentCore Gateway for an on-behalf-of token exchange with Microsoft Entra ID so an AI agent can call the ServiceNow REST API while preserving the calling user's identity.

• Without identity propagation, API calls arrive at downstream services as the application itself rather than the user who initiated the action, which breaks audit trails, bypasses user-level access controls, and violates the principle of least privilege.
• The architecture connects an agent application protected by Entra ID, an MCP server implemented with AgentCore Gateway, and the ServiceNow REST API configured with an inbound OAuth integration tied to Entra ID.
• The gateway sends the inbound token to the Entra token endpoint with the agent application's client credentials, the target scope, and requested_token_use: on_behalf_of; Entra validates that the calling user consented to the delegation and issues a new token for the ServiceNow API with the original user's claims intact.
• ServiceNow then receives a token whose preferred_username claim maps to an existing ServiceNow user and applies that user's permissions to the call.
• Setup requires an AWS account with AgentCore Gateway access, an Entra ID tenant with at least the Application Developer role, a ServiceNow instance with administrative access, and two Entra application registrations, one for the agent and one for the ServiceNow API connector.
• The pattern can be applied to other REST APIs protected by OAuth, and Amazon says identity propagation can be paired with Bedrock Guardrails in production.