A Bedrock Agent is an AWS-hosted AI agent that can orchestrate actions, query knowledge bases, and invoke models on behalf of a workload. In governance terms, it behaves like a non-human identity because its effective access comes from delegated permissions and attached tools, not from human login state.
Expanded Definition
A Bedrock Agent is not just a chat interface or a model wrapper. In NHI governance, it is an execution principal that can decide when to retrieve context, call tools, and complete actions on behalf of a workload. That means its security posture depends on delegated permissions, not on a human session, and it must be treated like a privileged non-human identity.
Definitions vary across vendors, but the operational distinction is consistent: an agent can combine reasoning with side effects. That places it closer to an automated service account than to a passive application component. NHI Management Group treats this as an identity-and-access problem as much as an AI problem, because tool access, data scope, and action boundaries all determine the real blast radius. This aligns with the risk framing in the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework.
The most common misapplication is granting a Bedrock Agent broad tool permissions because the underlying model is assumed to be “just advisory,” which occurs when teams overlook the agent’s delegated execution authority.
Examples and Use Cases
Implementing Bedrock Agents rigorously often introduces design friction, because every added tool, knowledge source, or action path increases governance overhead and the need for least-privilege review.
- An internal support agent queries a knowledge base, drafts a response, and opens a ticket only after a human approves the action path.
- A finance workflow agent retrieves policy documents and prepares account changes, but its credentials are limited to read-only data access until JIT approval is granted.
- A DevOps agent invokes deployment tools to update infrastructure, with scoped permissions and logging controls modeled after zero trust expectations from the NIST AI Risk Management Framework.
- A research assistant agent uses a vector store and an external API, but both are separated by explicit trust boundaries to reduce prompt-injection spillover, a pattern also reflected in the OWASP NHI Top 10.
- An AWS-hosted assistant is rotated out after a project ends, with its secrets revoked and its connected tools reviewed before any reuse of the identity.
These patterns match real-world incidents discussed by NHI Management Group, including the CoPhish OAuth Token Theft via Copilot Studio and the Replit AI Tool Database Deletion analyses, where tool access and execution authority became the central risk.
Why It Matters in NHI Security
Bedrock Agents matter because they can accumulate the same failure modes that define NHI compromise: excessive privileges, poor offboarding, and exposed secrets. NHI Management Group reports that 97% of NHIs carry excessive privileges and only 20% of organisations have formal offboarding processes for API keys and similar identities, which is why agent governance cannot be reduced to prompt safety alone. See the Ultimate Guide to NHIs — 2025 Outlook and Predictions for the broader risk context.
When a Bedrock Agent is allowed to act across systems, a single misbound role, leaked secret, or poisoned data source can convert a productivity feature into an incident. That is why agent permissions, tool inventories, and revocation paths should be reviewed as identity controls, not as application details. The issue also intersects with adversarial AI and tool-abuse patterns described in the MITRE ATLAS adversarial AI threat matrix and the CSA MAESTRO agentic AI threat modeling framework.
Organisations typically encounter the real importance of Bedrock Agent governance only after an agent over-reads data, triggers an unintended action, or leaks credentials, at which point identity scope becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Agent tool access and secrets map directly to NHI secret and privilege controls. |
| OWASP Agentic AI Top 10 | A2 | Agentic risks include unintended actions and tool abuse through delegated execution. |
| NIST AI RMF | NIST AI RMF frames agent risk around govern, map, measure, and manage functions. | |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero trust emphasizes least privilege and continuous verification for non-human executors. |
| CSA MAESTRO | MAESTRO focuses on threat modeling for agent planning, tools, and autonomy. |
Treat the agent as untrusted by default and verify every resource request before allowing execution.
