What happened
AWS Security Blog (Aug 18-19, 2026) detailed a reference architecture for Bedrock AgentCore that propagates end-user authorization context (via Cognito JWT claims, STS session tags, OAuth on-behalf-of) through to DynamoDB, Bedrock Knowledge Bases, and Salesforce, so downstream services — not the agent — enforce least privilege even under prompt injection or compromise.
Why it matters
Distinct from AWS's previously-covered Lambda-interceptor custom-auth pattern, this addresses a different failure mode (agent-as-trusted-gatekeeper over multi-source data access) and formalizes it as AGENTSEC03 best practice in AWS's Well-Architected Agentic AI Lens.
Applicability
Teams building multi-tenant/multi-department AI agents on Bedrock AgentCore that access DynamoDB, Knowledge Bases, or SaaS backends today.