AWS Amazon Bedrock AgentCore authorization patterns secure AI data access

This development addresses a critical vulnerability in agentic AI where prompt injection or application bugs could lead to broad data breaches. By moving authorization from the application code to the infrastructure layer, AWS provides a blueprint for streaming platforms to integrate AI assistants that handle sensitive subscriber or financial data without risking cross-tenant exposure. This approach aligns with the AWS Well-Architected Agentic AI Lens, signaling a shift toward standardized security protocols for autonomous enterprise tools. As streaming executives deploy more internal AI agents for CRM and analytics, watch for the adoption of these OBO token exchange patterns to maintain compliance across fragmented SaaS ecosystems.

Amazon Bedrock AgentCore reached general availability in October 2025, expanding its enterprise security posture with Virtual Private Cloud support, AWS PrivateLink, and resource tagging across all AgentCore services. AWS introduced AgentCore at its Summit New York City 2025 conference as a modular suite covering runtime, memory, identity, gateway, and observability, positioning it as framework-agnostic infrastructure for deploying AI agents at scale. The AgentCore Identity component specifically enables agents to access AWS services and third-party tools such as GitHub, Salesforce, and Slack either on behalf of users or with pre-authorized consent, directly addressing the authorization propagation pattern described in the new security blog post. Salesforce has built a parallel authorization architecture around its Einstein Trust Layer, which applies configurable data masking, zero data retention, and toxicity detection between the agent interface and underlying LLMs. Salesforce disabled data masking for Agentforce use cases after customers reported accuracy degradation and added latency, opting instead for zero-retention agreements with LLM providers and user-defined guardrails to govern what data agents can access. The company is adding Agentforce support for Anthropic Claude models hosted within the Salesforce trust boundary using Amazon Bedrock, keeping all LLM traffic inside the Salesforce VPC with TLS 1.2 encryption minimum. The AWS-Salesforce partnership deepened in December 2025 when the two companies introduced Agentforce 360 for AWS, running fully on AWS infrastructure with access to foundation models through Amazon Bedrock. The offering creates a secure perimeter where agent reasoning and data remain within the Salesforce Trust Boundary, built natively through Hyperforce and secured by the Agentforce Trust Layer. For streaming platforms evaluating AI agents that touch subscriber data, this convergence of infrastructure-level authorization (AWS AgentCore Identity with RFC 8693 token exchange) and application-level trust boundaries (Salesforce's zero-retention and masking controls) establishes a reference architecture for multi-vendor agentic deployments where user context must propagate without exposing cross-tenant data. To mitigate , security teams should prioritize these hardened gateway patterns, potentially leveraging to further unify identity management across these complex environments.