Govern AI agent tool access with Amazon Bedrock AgentCore Gateway
# Govern AI agent tool access with Amazon Bedrock AgentCore Gateway Whether they work with coding agents, autonomous agents, or human-interactive ones, and regardless of workload maturity, we start with the same question: “Which AI agents have access to customer data, who granted it, and what would exposure look like if a credential leaked today?” ## Solution walkthrough ### Scope 2: Control, identity-aware authorization and guardrails ```json { "principal": "user:alice@example.com", "action": "DeployCI___invoke", "resource": "gateway/pilot-gateway/target/DeployCI", "decision": "Deny", "matchedPolicy": "policy-payments-deploy-staging", "reason": "context.input.environment != 'staging'" } ``` ```json { "contentPolicyConfig": { "filtersConfig": [{ "type": "PROMPT_ATTACK", "inputStrength": "HIGH", "outputStrength": "NONE" }] }, "sensitiveInformationPolicyConfig": { "piiEntitiesConfig": [\ { "type": "EMAIL", "action": "ANONYMIZE" },\ { "type": "US_SOCIAL_SECURITY_NUMBER", "action": "BLOCK" },\ { "type": "CREDIT_DEBIT_CARD_NUMBER", "action": "BLOCK" }\ ] } } ``` ```json { "jsonrpc": "2.0", "id": 7, "error": { "code": -32042, "message": "authorization_required", "data": { "authorization_url": "https://oauth.example.com/auth?session_uri=urn:session:9f3a", "session_uri": "urn:session:9f3a" } } } ``` ## About the authors ### Resources - [What's New](https://aws.amazon.com/new?sc_ichannel=ha&sc_icampaign=acq_awsblogsb&sc_icontent=machine-learning-resources)