# AWS shows how to scope agent searches to each user's documents

published: 2026-11-12T16:05:35.498Z
topic: identity
source: https://aws.amazon.com/blogs/machine-learning/fine-grained-access-control-for-amazon-bedrock-managed-knowledge-base-tools/
url: https://aiagentnews.io/stories/aws-shows-how-to-scope-agent-searches-to-each-user-s-documents

AWS has published a pattern for limiting what an agent can retrieve from Amazon Bedrock Managed Knowledge Base, so the language model does not decide whose permissions apply. The design combines a gateway request interceptor, a Cedar policy check in AgentCore and a knowledge base resource policy, all based on the email from a verified identity token.

The post describes an internal assistant in which every employee shares one agent and knowledge base, yet each person sees only documents they are allowed to view. The knowledge base is exposed as MCP tools through Amazon Bedrock AgentCore Gateway, and trusted code rather than the model determines the user identity. Without this design, a search argument such as userContext could be set by the model through an error or a prompt injection.

A request interceptor, a Lambda function on the gateway, overwrites the userContext argument of each tools/call request with the email from the validated access token. Amazon Cognito adds that email claim through a pre token generation trigger, which requires the Essentials or Plus feature plan. Policy in AgentCore then compares the injected value with the email claim and denies any request where they differ.

The knowledge base uses ACL awareness to return only documents that the named user may view, and its resource-based policy denies Retrieve and GetDocumentContent to principals other than the gateway execution role. The post notes that ACL awareness filters results but does not authorize access by itself. Documents that fail ACL matching are silently left out of results rather than returning an error.

## Why it matters if you build agents

Developers who expose a knowledge base as an MCP tool should not let the model set a user identifier, because neither the gateway nor the knowledge base verifies that value. Injecting the verified email in code, checking it with a second policy and restricting direct calls with a resource policy gives independent layers if one control fails. Teams should also remember that ACL changes take effect only after the next sync and that missing ACL entries cause silent omissions.