用 Okta XAA 与 Amazon Bedrock AgentCore 治理 AI 智能体访问（上）
原标题：Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1
AI 摘要
AWS 博客介绍如何用 Okta Cross App Access（XAA）与 Amazon Bedrock AgentCore 治理 AI 智能体访问：在 Okta 中注册智能体并由管理员审批其可访问的应用，Okta 每次请求时评估策略；AgentCore Identity 负责兑换短期访问令牌并存入令牌库。测试中撤销用户对智能体的分配后约 1 秒内 Okta 即拒绝新请求，已签发令牌 5 分钟内过期，AgentCore Identity 为约 30 秒的端到端请求增加约 0.6 秒开销。
正文节选
Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1 An AI agent that updates a ticket or reads a customer record acts for a person, inside applications that person can reach. Your identity team then has to answer a question that per-app OAuth consent and shared service accounts leave open: which agent might act for which user in which application, and how you stop it. Okta Cross App Access (XAA) answers it in your identity provider (IdP). You register the agen