Bedrock AgentCore Gateway 实现 ServiceNow 代表用户令牌交换
原标题：ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway
AI 摘要
AWS 博客介绍如何通过 Amazon Bedrock AgentCore Gateway 配置代表用户（OBO）的令牌交换，使 AI 代理在调用 ServiceNow REST API 时保留发起用户的身份。方案涉及 Microsoft Entra ID 的两个应用注册（AI 代理与 ServiceNow API 连接器）以及 ServiceNow 入站 OAuth 集成，网关在每次请求时完成令牌交换。该模式可推广到其他受 OAuth 保护的 REST API，并可与 Bedrock Guardrails 配合使用。
正文节选
ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway AI agents that interact with enterprise APIs on behalf of users need to maintain user identity throughout the request chain. Without identity propagation, API calls arrive at downstream services as the application itself rather than the user who initiated the action. This breaks audit trails, bypasses user-level access controls, and violates the principle of least privilege. Amazon Bedrock AgentCore is a platform to build, con