Lighthouse AdvisorySLED AI Adoption Intelligence
← Back to results

From the ServiceNow edition of November 4, 2026

Vendor claimEmergingNew this fortnight

ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway

Amazon Web Services · Cloud/AI infrastructure integrating with ServiceNow · Global

ServiceNow
Publisher
AWS Machine Learning Blog
Original publication
2026-11-03
Source retrieved
2026-11-05
Read original source

What happened

AWS documents configuring Bedrock AgentCore Gateway (as an MCP server) to perform a Microsoft Entra ID on-behalf-of token exchange so an AI agent calls the ServiceNow REST API as the signed-in user; ServiceNow maps the preferred_username claim to a user and applies that user's permissions.

Why it matters

Relevant to agencies and universities using Entra ID and ServiceNow that want external AI agents to act in ServiceNow without a shared service account, preserving audit trails required for public records and accountability.

Evidence and measured results

Vendor how-to with configuration steps; no performance, security testing or customer deployment evidence. Uses a personal developer instance as an example.

Limitations and uncertainty

Vendor guidance only; AWS GovCloud/FedRAMP availability of AgentCore not addressed; cross-cloud data flow must meet state data residency rules.

Cross-source patterns this evidence supports

Put this evidence to work

Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.

Sales

Role takeaway
Customer problem
AI agents calling ServiceNow via shared service accounts break user-level audit trails and least privilege.
Stakeholders
  • Agency CIO
  • Identity/IAM lead
  • ServiceNow platform owner
  • CISO
Discovery questions
  • Do you use Entra ID as your IdP?
  • Are any agents calling ServiceNow with service accounts today?
  • Is AWS AgentCore available in your approved regions?
  • What audit requirements apply to agent actions?
Value hypothesis
User-scoped tokens may make agent actions attributable and permission-bound, easing audit concerns.
Potential engagement
An architecture review and non-production proof of concept of OBO identity propagation.
Unsupported claims
  • The pattern is FedRAMP or GovCloud ready
  • It has been deployed by any government
  • It eliminates all agent security risks

Pre-sales engineering

Role takeaway
Fit
Fits Entra ID plus ServiceNow environments evaluating AWS-hosted agents.
Architecture and integration
AgentCore Gateway MCP target performs Entra OBO exchange; ServiceNow inbound OIDC integration maps preferred_username.
Prerequisites
  • AWS account with AgentCore Gateway
  • Two Entra app registrations
  • ServiceNow admin access for inbound OAuth
Constraints
  • Government-cloud availability not addressed
  • Cross-cloud data residency rules
  • Requires user consent to delegation
Security
Keep JTI/uti replay protection, rotate client secret, and verify claim-to-user mapping.
Proof of value
  • ServiceNow audit logs show end user identity
  • Users lacking permissions are denied
  • Replayed tokens are rejected

Delivery

Role takeaway
Work
Build non-production POC of OBO flow and validate audit and access behavior.
Dependencies
  • Identity team
  • AWS account
  • ServiceNow sub-production instance
Ownership
Shared: IAM team and ServiceNow platform team.
Skills and adoption
Upskill engineers on OAuth OBO, OIDC claim mapping and AgentCore.
Governance checkpoints
  • Security review of delegation scope
  • Secret management approval
  • Data residency review
Acceptance criteria
  • Proposed: 100% of test agent actions attributed to end users
  • Proposed: unauthorized calls blocked in tests
Risks
  • Incorrect claim mapping
  • Client secret exposure
  • Disabled replay protection

Implementation considerations

Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.

Architecture and integration

What must connect, and where does the AI sit in the workflow?

Three-party architecture (AWS AgentCore Gateway, Entra ID, ServiceNow inbound OIDC integration) with two Entra app registrations and a client secret held by the gateway.

Governance

Who approves, reviews and stays accountable for outcomes?

User-level identity propagation supports least privilege and auditable agent actions; requires user consent to delegation and governance of the user_impersonation scope.

Security and privacy

What data, permissions and controls need testing?

Preserves user permissions and audit trails; the guide notes clearing JTI verification if absent and suggests mapping Entra's uti claim for replay protection—teams should not skip replay controls. Client secret management is required.

Accessibility and workforce

Who is affected, and what skills or accommodations follow?

Requires identity engineering skills across Entra, AWS and ServiceNow.

Procurement

What should contracts, pricing and exit terms secure?

Adds AWS AgentCore consumption costs and multi-vendor support boundaries.

Operating model

Which teams own the service once it runs?

Identity, cloud and ServiceNow teams must jointly own the integration and secret rotation.

Publication history

  1. 2026-11-04ServiceNow · Issue 053 resources
Read preserved resource versions (JSON)

Stable resource ID: aws-agentcore-gateway-obo-token-exchange-servicenow