{"resourceId":"aws-agentcore-gateway-obo-token-exchange-servicenow","versions":[{"version":"external-6dd1c844dc0e7048a4f75294e676bc5575163f8df47ba25912631666ec02f96b","resource":{"id":"aws-agentcore-gateway-obo-token-exchange-servicenow","title":"ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway","organization":"Amazon Web Services","sector":"Cloud/AI infrastructure integrating with ServiceNow","geography":"Global","publishedAt":"2026-11-03","publicationDate":"2026-11-03","eventDate":null,"sourceName":"AWS Machine Learning Blog","sourceLabel":"Vendor technical how-to (AWS)","sourceUrl":"https://aws.amazon.com/blogs/machine-learning/servicenow-on-behalf-of-token-exchange-with-bedrock-agentcore-gateway/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","data-security","infrastructure"],"finding":"AWS documents configuring Bedrock AgentCore Gateway (as an MCP server) to perform a Microsoft Entra ID on-behalf-of token exchange so an AI agent calls the ServiceNow REST API as the signed-in user; ServiceNow maps the preferred_username claim to a user and applies that user's permissions.","sledRelevance":"Relevant to agencies and universities using Entra ID and ServiceNow that want external AI agents to act in ServiceNow without a shared service account, preserving audit trails required for public records and accountability.","evidence":"Vendor how-to with configuration steps; no performance, security testing or customer deployment evidence. Uses a personal developer instance as an example.","architectureImplications":"Three-party architecture (AWS AgentCore Gateway, Entra ID, ServiceNow inbound OIDC integration) with two Entra app registrations and a client secret held by the gateway.","governanceImplications":"User-level identity propagation supports least privilege and auditable agent actions; requires user consent to delegation and governance of the user_impersonation scope.","securityPrivacyImplications":"Preserves user permissions and audit trails; the guide notes clearing JTI verification if absent and suggests mapping Entra's uti claim for replay protection—teams should not skip replay controls. Client secret management is required.","caveats":"Vendor guidance only; AWS GovCloud/FedRAMP availability of AgentCore not addressed; cross-cloud data flow must meet state data residency rules.","streamIds":["servicenow"],"roles":{"sales":"Frame as auditability for AI agents: SLED CIOs worry that agents acting through service accounts break accountability. This AWS pattern shows a way for agents to act in ServiceNow as the actual user. It is vendor guidance without deployment results, so offer an architecture review, not a production promise, and confirm government-cloud availability first.","engineering":"Fit requires Entra ID, AgentCore Gateway and admin access to ServiceNow inbound OAuth. Engineers configure two Entra app registrations, a user_impersonation scope, an OIDC provider in ServiceNow mapping preferred_username, and the gateway OBO target. Keep replay protection by mapping uti to jti rather than disabling JTI checks. Confirm AgentCore availability in required regions or GovCloud.","delivery":"Delivery would be a proof of concept in a non-production instance demonstrating user-scoped agent calls and audit records. Interpretation: acceptance should verify that ServiceNow logs show the end user, not a service account, and that denied users are blocked. Identity and platform teams share ownership. Risks include secret mismanagement and claim-mapping errors that map users incorrectly."},"roleDetails":{"sales":{"customerProblem":"AI agents calling ServiceNow via shared service accounts break user-level audit trails and least privilege.","stakeholders":["Agency CIO","Identity/IAM lead","ServiceNow platform owner","CISO"],"discoveryQuestions":["Do you use Entra ID as your IdP?","Are any agents calling ServiceNow with service accounts today?","Is AWS AgentCore available in your approved regions?","What audit requirements apply to agent actions?"],"valueHypothesis":"User-scoped tokens may make agent actions attributable and permission-bound, easing audit concerns.","potentialEngagement":"An architecture review and non-production proof of concept of OBO identity propagation.","unsupportedClaims":["The pattern is FedRAMP or GovCloud ready","It has been deployed by any government","It eliminates all agent security risks"]},"engineering":{"fit":"Fits Entra ID plus ServiceNow environments evaluating AWS-hosted agents.","architectureIntegration":"AgentCore Gateway MCP target performs Entra OBO exchange; ServiceNow inbound OIDC integration maps preferred_username.","prerequisites":["AWS account with AgentCore Gateway","Two Entra app registrations","ServiceNow admin access for inbound OAuth"],"constraints":["Government-cloud availability not addressed","Cross-cloud data residency rules","Requires user consent to delegation"],"security":"Keep JTI/uti replay protection, rotate client secret, and verify claim-to-user mapping.","proofOfValue":["ServiceNow audit logs show end user identity","Users lacking permissions are denied","Replayed tokens are rejected"]},"delivery":{"work":"Build non-production POC of OBO flow and validate audit and access behavior.","dependencies":["Identity team","AWS account","ServiceNow sub-production instance"],"ownership":"Shared: IAM team and ServiceNow platform team.","skillsAdoption":"Upskill engineers on OAuth OBO, OIDC claim mapping and AgentCore.","governanceCheckpoints":["Security review of delegation scope","Secret management approval","Data residency review"],"acceptanceCriteria":["Proposed: 100% of test agent actions attributed to end users","Proposed: unauthorized calls blocked in tests"],"risks":["Incorrect claim mapping","Client secret exposure","Disabled replay protection"]}},"retrievedAt":"2026-11-05T04:10:32Z","enrichedAt":"2026-11-05T04:12:12Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires identity engineering skills across Entra, AWS and ServiceNow.","procurementImplications":"Adds AWS AgentCore consumption costs and multi-vendor support boundaries.","operatingModelImplications":"Identity, cloud and ServiceNow teams must jointly own the integration and secret rotation.","sourceVerification":{"openedUrl":"https://aws.amazon.com/blogs/machine-learning/servicenow-on-behalf-of-token-exchange-with-bedrock-agentcore-gateway/","referenceExcerpt":"Without identity propagation, API calls arrive at downstream services as the application itself rather than the user who initiated the action.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}