用 Okta XAA 与 Amazon Bedrock AgentCore 治理 AI agent 访问（下）
原标题：Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 2
AI 摘要
AWS 发布博客第二部分，介绍如何用 Okta Cross App Access 与 Amazon Bedrock AgentCore 治理 AI agent 访问。文章将第一部分的单 agent、双 MCP 服务器拓扑升级为通过 AgentCore Gateway 统一入口，由 Gateway 兑换 Okta 授权、用 Cedar 策略做默认拒绝的授权校验，并让运行在 Amazon EKS 上的第二个 agent 以自身 Okta 身份接入，同时用 AgentCore Observability 与 CloudWatch 集中记录所有决策。
正文节选
Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 2 In Part 1, you built a task agent on Amazon Bedrock AgentCore, a platform to build, connect, and optimize agents at scale, with any framework or model. The agent runs on Amazon Bedrock AgentCore runtime, a capability of Amazon Bedrock AgentCore, and acts for signed-in users through Okta Cross App Access (XAA). Okta decided which agent might act for which user, and Amazon Bedrock AgentCore Identity, a capabili