AWS shows agents calling ServiceNow with the user's own permissions, not their own
AWS described on 3 November how Amazon Bedrock AgentCore Gateway can use an on-behalf-of token exchange so an agent calls ServiceNow as the person who asked. The gateway sends the agent's incoming token to Microsoft Entra ID, which checks that the user consented to the delegation before issuing a new token scoped to the ServiceNow connector. ServiceNow then maps the token to an existing user and applies that user's permissions to the call.
The authors note that without this, downstream calls are made as the application, which breaks audit trails. They recommend limiting the scope to only the ServiceNow APIs the agent needs, such as the Table API, and mapping Entra's token identifier for replay protection. Native support needs MCP version 2025-11-25.
An agent acting with the user's permissions can never do more than that user could, and every action is logged under a real name. That's a better default than one service account that can do everything.
Drafted with AI from the original source, then checked and edited by Sridhar Mukkandi. Spotted a mistake? Write to hello@tarkika.com and we'll correct it here.