Agents that call enterprise APIs often send requests as the application rather than the user, which breaks audit trails and bypasses user-level access controls. The AWS Machine Learning blog shows how AgentCore Gateway can handle the on-behalf-of (OBO) flow with Microsoft Entra ID, swapping the agent's token for one scoped to the ServiceNow API connector while keeping the user's claims intact.
Setup involves two Entra app registrations, one for the agent and one for the ServiceNow connector that exposes a user_impersonation scope. ServiceNow needs an inbound OAuth integration that maps the preferred_username claim to a user's email field and limits the auth scope to the Table API. The gateway must use MCP version 2025-11-25, because native OBO cannot be enabled on gateways created with earlier versions.
On the gateway target, the token exchange grant takes the scope api://5d4a7a11-xxxx-xxxx-xxxx-xxxxxxxxxxxx/user_impersonation and a custom parameter, requested_token_use set to on_behalf_of. AWS says that without this parameter, the ServiceNow call fails with an authentication error. The same approach can be applied to other REST APIs protected by OAuth.
Why it matters if you build agents
Teams building agents on AgentCore can drop custom AWS Lambda interceptors for token exchange and keep ServiceNow's user-level permissions in effect for each call. If you adopt this, confirm the gateway uses MCP version 2025-11-25 and that the ServiceNow user mapping matches preferred_username, since those settings are the likely sources of failures.
Get stories like this every weekday
One short email with the day's agent tooling news.