TL;DR: Teleport explains that AI agent tool calls into Amazon Bedrock AgentCore can lose caller identity, leaving CloudTrail tied to a shared role and weakening accountability across AWS actions. The real gap is the assumption that downstream execution still maps cleanly to the initiating principal, which breaks once the agent mediates access.
At a glance
What this is: This is a Teleport analysis of how Amazon Bedrock AgentCore can drop caller identity across agent tool calls, creating shared-role execution and weak auditability.
Why it matters: IAM and platform teams need to treat identity propagation as a control requirement, because delegated AI access is only governable when the originating principal survives the full execution chain.
👉 Read Teleport's analysis of AWS agent identity propagation in AgentCore
Context
Identity propagation is the control that carries the original caller through a mediated execution chain so downstream systems can still tell who requested an action. In this article, the gap appears when an AI agent invokes AWS through Amazon Bedrock AgentCore and the resulting CloudTrail event reflects a shared role rather than the initiating user.
That breaks accountability, overstates shared permissions, and creates stale access when people leave but agent-powered access paths remain active. The issue sits at the boundary between agent orchestration, IAM, and audit logging, which is why it matters to teams governing NHI, human identity, and agent-mediated access together.
Teleport argues that AgentCore is the natural chokepoint because every tool call passes through it, but the underlying problem is broader than one gateway. Any delegated workflow that loses principal context will struggle to enforce least privilege, trace decisions, or prove who used what access.
Key questions
Q: What breaks when AgentCore does not propagate caller identity to AWS?
A: The downstream tool and CloudTrail record only the shared execution context, not the initiating principal. That breaks accountability, makes authorization decisions harder to defend, and leaves no reliable way to distinguish one user’s action from another’s when the same agent path serves multiple callers.
Q: Why does shared-role execution increase risk in delegated AI workflows?
A: Shared-role execution forces multiple callers through the same downstream permission set, which pushes teams toward over-provisioning or blocking legitimate use. It also weakens attribution, so security teams lose the ability to connect an action to a specific principal when something goes wrong.
Q: How do security teams know whether agent-mediated AWS access is governable?
A: They should verify that the initiating identity survives into the authorization decision, the tool invocation, and the cloud audit trail. If any of those layers collapse into a gateway-only identity, the workflow is only partially governable and cannot support strong accountability.
Q: What should teams do when an AI agent accesses AWS on behalf of users?
A: They should require request-time identity propagation, then evaluate each tool call against the caller’s verified roles before execution. That gives downstream functions a principal they can trust and prevents the agent gateway from becoming an anonymous permission broker.
Technical breakdown
Why identity disappears in AgentCore tool calls
Amazon Bedrock AgentCore acts as a managed MCP gateway, so it can validate that a request is structurally sound without preserving the original caller’s identity into the downstream tool chain. That means the Lambda or AWS API sees the gateway as the invoker, not the human or workflow principal behind the request. In practice, this turns the agent layer into an identity translation boundary. If the boundary stops at validation and does not propagate claims, the authorization model collapses into shared execution and indistinct audit records.
Practical implication: Treat any agent gateway as an identity boundary unless it explicitly preserves caller context end to end.
Why shared IAM roles break accountability
When multiple users execute through the same agent path, the default fallback is a common IAM role or service context. That can simplify implementation, but it destroys per-user attribution and forces teams to choose between over-provisioning the role or breaking legitimate use cases. CloudTrail then records activity under the shared execution context, which is operationally useful but governance-poor. The technical failure is not logging alone, but the loss of principal fidelity before the cloud control plane sees the request.
Practical implication: Design the permission model so each downstream action remains attributable to a unique initiating principal.
How request-time identity propagation restores policy decisions
The article’s pattern uses a short-lived signed JWT, validated at the gateway and then forwarded through an interceptor so the downstream tool receives verified identity claims as parameters. That allows policy engines such as Amazon Verified Permissions to evaluate the request against the caller’s role before the tool executes. This is not just authentication. It is identity continuity plus per-tool authorization, which lets the downstream function act on already-verified caller context instead of a generic session label.
Practical implication: Pass verified identity into the tool invocation itself so authorization can happen at request time, not after execution.
Threat narrative
Attacker objective: The objective is not classic compromise but untraceable delegated access that prevents accurate attribution and weakens control over privileged AWS actions.
- Entry occurs when a user asks an AI agent to perform an AWS action and the request is routed through AgentCore to a downstream tool.
- Credential or identity context is lost when the gateway validates the request but does not preserve the caller identity for the Lambda or AWS API call.
- Escalation appears as shared-role execution, where multiple users inherit the same downstream permissions and the audit trail no longer distinguishes them.
- Impact is weak accountability and stale access, because CloudTrail cannot cleanly attribute actions and departed users may still benefit from the shared agent path.
Breaches seen in the wild
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity propagation is the control plane for delegated AI access: when an agent mediates AWS actions, the real governance question is whether the initiating principal survives the full path. If that identity drops out at the gateway, downstream permissions become shared, attribution becomes approximate, and audit evidence stops supporting accountability. Practitioners should treat propagated identity as a required control, not an implementation detail.
The assumption that cloud activity maps cleanly to a stable principal is already breaking: that assumption was designed for direct user sessions and well-bounded service automation. It fails when an AI agent intermediates the request because the execution context can outlive, aggregate, or obscure the original caller. The implication is that identity governance must move from session-centric review to request-centric continuity.
AgentCore exposes an identity blast radius problem, not just an authorization gap: once one shared execution path serves many users, every permission decision inherits the weakest governance point in the chain. That creates over-provisioning pressure, stale access risk, and correlation failures across telemetry sources. The practitioner takeaway is to measure how far a single downstream role can stretch across distinct callers.
Per-tool authorization only works when the tool receives the caller as a verified parameter: otherwise the policy engine can only judge the gateway, not the person or workflow behind it. That is why a JWT, interceptor, and policy check belong together. Without all three, the downstream system is forced to trust an execution shell instead of the authenticated principal.
Agentic AI identity must be governed as a lifecycle, not a one-time login event: the article shows that access persists after people leave unless the downstream chain is tied to the individual. That is the same governance failure pattern seen in other non-human identities, but here it is amplified by delegated execution and hidden context loss. The implication is that identity offboarding must extend through agent-mediated access paths.
From our research library:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Read next: Zero Trust for AI Agents
What this signals
Identity continuity is the missing governance layer in agent-mediated AWS access: teams cannot rely on CloudTrail alone when the gateway strips the initiating principal from the downstream request. The practical shift is from logging after execution to preserving identity before the tool runs, which is where policy engines can still make a meaningful decision.
Agentic AI identity and NHI governance are converging on the same control problem: a short-lived JWT, a verified authorization check, and an attributable audit trail are now part of one chain, not separate tasks. If any link is missing, the programme may still function technically, but it will not function governably.
Identity blast radius: the closer an agent path gets to shared execution, the wider the operational blast radius becomes for permissions, attribution, and offboarding. Security teams should expect this pattern anywhere a managed gateway mediates tool access without passing verified caller context forward.
For practitioners
- Implement end-to-end identity propagation Preserve the original caller identity from authentication through the agent gateway, interceptor, tool function, and AWS API call so downstream telemetry remains attributable.
- Replace shared execution roles with caller-scoped authorization Avoid one generic IAM role for all agent users when the role would blur who invoked the action. Use per-request policy evaluation so the downstream tool executes under verified caller context.
- Validate audit correlation across all three logs Check that session logs, authorization decisions, and CloudTrail records all point to the same initiating principal so investigations do not depend on inference.
Key takeaways
- AI agent access to AWS becomes hard to govern when the original caller identity disappears between the gateway and the cloud action.
- Shared execution roles can make CloudTrail readable but not accountable, which is the wrong trade-off for delegated access.
- Request-time identity propagation, paired with per-tool authorization, is the control that keeps agent-mediated AWS activity attributable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on identity loss and privilege reuse across an agentic execution path. |
| Recommendation — Enforce per-request identity continuity so agentic tools cannot execute under ambiguous privilege. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | AgentCore validates a request but drops caller identity, creating an authentication continuity gap. |
| NHI-05 — Overprivileged NHI | Shared execution roles force over-provisioning or break legitimate use cases across users. | |
| Recommendation — Propagate verified caller identity through the full NHI request path before downstream execution. Scope downstream NHI permissions to the initiating principal instead of a shared agent role. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about preserving authorization context across delegated AWS access. |
| Recommendation — Bind each agent action to the correct permissions and authorizations before the tool executes. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Shared downstream access broadens where a caller can operate and obscures attribution in the chain. |
| Recommendation — Map delegated agent paths to credential access and lateral movement exposure in detection and review. | ||
Key terms
- Identity propagation: The preservation of origin and acting principal information as a request moves through multiple services. In MCP chains, this is what allows downstream systems to make a trustworthy authorization decision instead of relying on a stripped-down token with no task context.
- Identity Continuity: Identity continuity is the ability to preserve a workload’s verified identity across proxies, services, and other infrastructure boundaries. It matters because zero trust breaks down when a request loses its original proof of identity and falls back to network trust or header-based assumptions.
- Agent gateway: The local or remote control layer that authenticates, pairs, and orchestrates an AI agent’s actions across connected tools. In practice it becomes an identity concentrator, because one gateway session can govern messages, commands, and downstream systems with far broader reach than the user interface suggests.
- Shared Execution Role: A shared execution role is a common downstream identity used by multiple callers to perform actions through a service or agent path. It simplifies access design but usually weakens least privilege, audit fidelity, and offboarding because the same role hides who actually initiated each action.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- The exact JWT issuance and header-rewrite flow used to carry identity through AgentCore.
- The interceptor pattern that injects verified identity claims into tool-call arguments.
- The Cedar policy examples used for per-tool authorization decisions.
- The notebook-style setup sequence that demonstrates the full AWS configuration end to end.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org