Amazon Bedrock AgentCore IAM and data access controls run through execution roles, a workload identity directory, gateway inbound and outbound authorization, and Cedar policy evaluation, layered over encryption and microVM isolation. For AWS architects, the main risk is clear: these controls govern which agent may call which tool, not what data moves inside that call. Security teams need inline inspection at the tool-call payload. Aurascape classifies sensitive data before a call executes, giving teams interaction-level control and evidence.

Last updated: July 2026.

Enterprises are moving from employees using AI tools to agents that reason, retrieve data, and take actions on their behalf. Amazon Bedrock AgentCore gives AWS teams a managed runtime, gateway, memory, and identity service for AI agents at scale. AgentCore is worth evaluating because it separates reachability from payload risk: IAM can approve a tool call while sensitive data still moves inside it.

This guide walks the identity model, the gateway authorization path, credential storage, registry governance, multi-tenant isolation, data retention, and audit, then shows the governance gap that IAM alone leaves open.

AgentCore permissions: scope execution roles per agent function

Least privilege for AI agents means each agent runs under an execution role scoped only to the AWS resources its task requires, with no standing access to data or services it never touches. AgentCore supports both identity-based IAM policies attached to principals and resource-based policies attached to AgentCore resources, so architects can constrain who invokes a runtime and what that runtime can reach.

A retrieval agent that reads one S3 prefix should not carry write access to a production database because it shares a role with an automation agent. Role separation limits blast radius when any single agent misbehaves or gets misused. Role scope decides reachability, not the sensitivity of the data that flows once reach is granted. An over-privileged role widens the blast radius; a well-scoped role still lets any data the role can reach pass through a permitted request.

Gartner projects that at least 80 percent of unauthorized AI transactions will come from internal policy violations rather than malicious attacks, which is why the policy layer must extend to interaction content, not only to call authorization (Gartner, 2025).

Workload identity, authorizer, and delegated credentials for service access

AgentCore provides a workload identity directory so each agent holds its own managed identity for reaching AWS and third-party services, rather than inheriting a human user’s credentials. A companion authorizer evaluates whether a given identity may perform a specific action before the request proceeds. For external services, AgentCore supports OAuth 2.0 and OpenID Connect (OIDC) federation, so an agent obtains a delegated, scoped token for a downstream system instead of holding a long-lived static key.

The split between identity, authorizer, and delegated credentials matters for AWS architects. The workload identity directory establishes who the agent is. The authorizer decides whether that identity may take a specific action. Delegated OAuth or OIDC tokens narrow what a permitted action can reach in a downstream system. None of the three evaluates what the agent then sends through the channel it has been cleared to use.

The gap shows up when teams can authorize an agent but cannot explain the content or purpose of the action it took. Only 28 percent of organizations can trace agent actions back to a human sponsor across all environments (Cloud Security Alliance, 2026). Identity plumbing establishes who the agent is. A separate interaction layer decides whether the specific content of the action it is about to take is acceptable.

AgentCore secrets: keep credentials and tokens out of prompts and source code

AgentCore stores agent credentials and delegated tokens in a managed resource credential provider and token vault, keeping secrets out of prompts, environment variables, and source files. For developer-facing agents this closes one of the sharpest exposure paths. Secrets and repository context often leak through agent context windows, a risk covered in depth for source code exposure via AI coding assistants and for Claude Code and company source code risks.

Take a coding agent in a continuous integration and delivery (CI/CD) pipeline. It reads a repository token from the vault, invokes a build tool, and passes a diff back to a code-review service. The vault protected the token at rest, and the diff can still carry proprietary source code, an embedded API key, or a customer identifier into the review service through a permitted request. Storage hygiene and content governance are separate, complementary controls, and the CI/CD path is where they diverge most clearly.

The National Cybersecurity Alliance found that 43 percent of employees admit sharing sensitive workplace information with AI tools without employer knowledge, including internal documents in 50 percent of cases and financial data in 42 percent (National Cybersecurity Alliance, 2025). That pattern carries straight into agents acting on employee credentials: a valid token from a well-secured vault can still move the same sensitive data through a permitted call.

Gateway dual authentication and Cedar policy enforce tool-call authorization

The AgentCore Gateway routes tool calls through a dual authentication model: inbound request validation confirms the caller is an authorized agent, and outbound connection authorization confirms the gateway may reach the target tool or service. Gateway interceptors and Cedar policy evaluation make fine-grained allow or deny decisions at the request boundary. AWS has also described a natural-language access policy covering which tools, APIs, Lambda functions, MCP servers, and third-party service agents an agent may reach, and under what conditions.

Model Context Protocol (MCP) is one common tool-execution pattern the gateway routes, not the whole agent access-control problem; agents also invoke internal APIs, Lambda functions, and services outside any MCP path. Cedar rules decide whether a principal may invoke a tool under defined conditions. Evaluating payload sensitivity, accumulated conversation context, and intent drift takes separate interaction controls.

OWASP ranks Prompt Injection (LLM01), Sensitive Information Disclosure (LLM02), and Excessive Agency (LLM06) among the top risks for AI applications (OWASP, 2025). Prompt injection and excessive agency both bite here: an agent can be authorized to act and still be steered toward the wrong data, tool, or outcome. A permitted destination can still carry an impermissible interaction. The World Economic Forum reports that 87 percent of security leaders flag AI vulnerabilities as the fastest-growing cyber risk (World Economic Forum, 2026), and the authorization boundary is exactly where that surface widens when tool calls are permitted but unexamined.

AgentCore data retention: memory, isolation, and the shared responsibility model

Under the AWS shared responsibility model, AWS secures the infrastructure and the managed AgentCore services, while the customer configures roles, policies, encryption keys, network placement, and what data agents may process and store. Data protection is a shared task: encryption at rest and in transit is provided, but classifying what enters agent memory or a tool call stays a customer control.

AgentCore Memory retains context across turns and sessions so an agent can carry state. That retained context is itself sensitive data: a customer record or a source-code snippet pulled into memory in one turn can resurface in a later tool call. Teams should set retention scope, expiration, and which data categories may be written to memory at all. The retention risk that builds up in agent memory and MCP context is covered in agent memory and MCP context retention risks.

For multi-tenant workloads, AgentCore runs each agent session in an isolated microVM and sanitizes memory between sessions to limit cross-session data bleed. Session-to-user mapping is left to the calling application backend, so the platform enforces runtime isolation while the application layer binds a session to a specific human or tenant. At general availability, AWS added Virtual Private Cloud support, PrivateLink, CloudFormation, and resource tagging as the enterprise network-isolation layer.

AgentCore audit logs and registry governance for the tool supply chain

AgentCore maintains an agent and tool registry with an approval workflow that moves agents and tools through defined state transitions before they become discoverable and invocable. Where the registry is the required publishing path, approval state decides whether an agent or tool becomes discoverable and invocable through the managed workflow. That approval gate is the platform’s primary control over the tool supply chain.

For observability, AgentCore emits CloudWatch logs, EventBridge events, and gateway dashboards. Each source proves something different, as the table below shows. Compliance teams also need evidence that explains the data exchanged, the attempted action, and the policy decision, which a status-level log does not capture.

The Cloud Security Alliance found that 82 percent of organizations have unknown AI agents in their environment and 65 percent have experienced agent-related incidents (Cloud Security Alliance, 2026). Agents that never enter the registry sit outside the approval workflow and the managed gateway. Finding them takes proactive local discovery across network, endpoint, and API planes, whether or not a managed platform tracks them. For the broader risk of giving agents unrestricted tool access, see the risks of giving an agent repository, terminal, and MCP access and AI agent security and compliance risks.

Where interaction-level control closes the governance gap

Platform-native controls decide which agent may reach which tool. Interaction-level control inspects the payload, conversation context, intended action, and policy outcome before the call completes. The evaluation rule for any enterprise deploying AgentCore is simple: if a control operates at the authorization boundary but not at the content level, a cleared call can still move regulated data, source code, secrets, or tenant-specific records to a cleared destination.

Aurascape discovers and secures local AI agents and their interactions, and adds a Zero-Bypass MCP Gateway that cryptographically signs approved tool calls and blocks unsigned ones, governing the agent-to-tool execution path inline rather than observing it (Aurascape, 2026). It classifies sensitive data inside the tool-call payload with 600+ real-time data classifiers before a call completes, and carries conversation-level context across the exchange to catch intent drift across turns (Aurascape, 2026). Where a Cedar rule returns allow or deny, Aurascape applies five context-aware policy actions: allow, coach, warn, block, and redact, so a call carrying regulated fields gets redacted rather than dropped entirely.

Aurascape also finds agents that never entered the AgentCore registry. Discovery works in two dimensions: find AI across network, endpoint, and API planes, and a patented proactive zero-day capability where agents crawl the web and interrogate new tools before first employee use. Shadow agents that skip the approval workflow surface for interaction-level governance even when a managed registry does not track them.

Deployment checklist and control comparison

This sequence covers the full control stack, from IAM role scoping through interaction-layer governance:

1. Scope each agent execution role to the minimum AWS resources its task requires, per function, not per team. Combine identity-based and resource-based policies.
2. Issue workload identities through the AgentCore identity directory and use the authorizer to restrict which identities may invoke which actions.
3. Federate external service access with OAuth 2.0 or OIDC, and keep static keys out of agent code, prompts, and environment variables.
4. Store all credentials and delegated tokens in the managed token vault, not in source files or context windows.
5. Define AgentCore Memory retention scope and restrict which data categories may be written to memory across sessions.
6. Enforce gateway dual authentication and Cedar interceptors to decide which agent may reach which tool or MCP server.
7. Register agents and tools through the approval workflow before they become discoverable, and enforce state transitions to keep the tool supply chain governed.
8. Add inline data classification at the tool-call payload so sensitive content is classified before execution completes and the right policy action applies.
9. Discover agents operating outside the registry and produce interaction-level records that capture the data exchanged, action attempted, and policy decision, governed by role-based access control (RBAC) for privacy.

The table below states each native AgentCore control first, then the residual risk and the compensating interaction-layer control.

Aurascape is additive to an existing SSE, SASE, CASB, Data Loss Prevention (DLP), or SWG stack, with no rip-and-replace. It adds the interaction-layer controls that authorization-boundary policy does not perform.

Frequently asked questions

How should IAM permissions be configured for Amazon Bedrock AgentCore agents?

Scope each agent’s execution role to the minimum AWS resources its task needs, per function. Combine identity-based policies on principals with resource-based policies on AgentCore resources, and bind permissions to workload identities through the authorizer. Then inspect the data those permissions let agents move, so a well-scoped role does not silently pass regulated content.

How does Amazon Bedrock AgentCore handle secrets?

AgentCore stores credentials and delegated tokens in a managed token vault and supports OAuth 2.0 and OIDC federation for external services, keeping secrets out of prompts, environment variables, and source code. A valid stored credential can still send sensitive data through a permitted call, which is where content-level governance adds a second layer.

Can AgentCore prevent source code from leaking through a tool call?

AgentCore encrypts data and authorizes which tool a coding agent may reach, but the authorization decision does not read the payload. A permitted call to a build or review service can still carry proprietary source code or an embedded key. Classifying the payload at the tool-call level before execution completes is what stops that leak.

How does Amazon Bedrock AgentCore handle data retention?

AgentCore Memory retains context across turns and sessions, and microVM isolation sanitizes memory between sessions. Retained context can itself hold sensitive data, so teams should set retention scope, expiration, and which data categories may be written to memory. Encryption is provided; deciding what enters memory is a customer control.

What does the Amazon Bedrock AgentCore Gateway enforce?

The gateway validates the inbound caller and authorizes the outbound connection, then applies Cedar policy through interceptors to allow or deny a tool call at the request boundary. It routes MCP and other tool calls but decides authorization, not payload sensitivity or conversation context across turns.

Are Amazon Bedrock AgentCore audit logs enough for compliance?

CloudWatch logs, EventBridge events, and gateway dashboards show tool activity, lifecycle events, and operational status. Compliance for AI agents usually also requires evidence of what data was exchanged, what the agent intended, and which policy action applied. Interaction-level records supply that attestable layer alongside the platform logs.

How does Amazon Bedrock AgentCore support multi-tenant compliance?

AgentCore isolates each session in a microVM and sanitizes memory between sessions, while session-to-tenant mapping is the calling application’s responsibility. VPC and PrivateLink add network isolation. Inline content governance adds a further control so tenant-specific data does not cross a session boundary through a misrouted but permitted call.

What about agents that never register with the AgentCore registry?

Unregistered agents fall outside the approval workflow and the managed gateway. Proactive local discovery finds AI apps, accounts, and agents across network, endpoint, and API planes whether or not a managed platform tracks them, so ungoverned agents surface for inline control instead of running undetected.

Does Aurascape replace AgentCore’s IAM controls?

No. AgentCore handles execution roles, gateway authorization, and Cedar policy. Aurascape adds runtime inspection of payloads, conversation context, local agent activity, and policy evidence.

Aurascape adds the interaction layer Amazon Bedrock AgentCore deployments need: payload classification with 600+ real-time data classifiers, conversation-level context correlation, local agent discovery, inline tool-call governance with five policy actions, and RBAC-governed interaction records for each policy decision. That turns a well-configured authorization stack into runtime governance for production AI agents.

See how Aurascape governs agent tool calls in Amazon Bedrock AgentCore deployments →