Topic starter
25/08/2026 6:10 pm
TL;DR: Amazon Bedrock agents, roles, knowledge bases, prompts, and guardrails can be represented as first-class non-human identities in a single access graph, with the IAM role carrying the true blast radius and automatic discovery following the next AWS extraction, according to Veza. That matters because identity review, least privilege, and access tracing must extend to AI agents, not stop at human users.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “Inside Veza’s AI Agent Security for Amazon Bedrock Agents: A Technical Deep Dive”.
Key questions
Q: What breaks when a Bedrock agent is treated as an application instead of an identity?
A: The governance model breaks because the agent’s permissions are really inherited through a delegated IAM role, not expressed by the agent itself.
Q: Why do Bedrock agents increase NHI governance risk even when the model is unchanged?
A: Because the risk comes from delegated access, not model quality.
Q: How do security teams know whether an AI assistant is actually constrained?
A: They know by testing whether the model stays inside its boundaries across many prompt variants, not just direct requests.
Practitioner guidance
- Treat Bedrock agents as reviewable NHI records Add every agent to the identity inventory with its assumed role, connected knowledge bases, guardrails, and invoking principals so reviewers can assess it as an access-bearing entity.
- Trace the assumed role as the true control boundary Document the CAN_ASSUME_ROLE hop and use the role’s effective permissions as the basis for blast-radius assessment, privilege review, and exception handling.
- Separate invocation rights from downstream resource reach Review who can invoke or modify the agent independently from what the agent can read, write, or execute across S3, DynamoDB, Lambda, SharePoint, Confluence, and Salesforce.
Bottom line: Bedrock agents become governance-relevant the moment they inherit an IAM role and start acting through delegated permissions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
25/08/2026 6:11 pm
Bedrock agents should be governed as non-human identities, not as feature objects. The article’s strongest contribution is the access-graph framing: the agent, the assumed role, the knowledge base, and the downstream resources belong in the same governance model. That is exactly how NHI programmes should treat delegated machine action, because the permission boundary lives in the identity chain, not in the product label. Practitioners should make AI agents reviewable, searchable, and attributable in the same control plane as other non-human identities.
A few things that frame the scale:
- Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
A question worth separating out:
Q: Should teams use one access review process for humans, service accounts, and Bedrock agents?
A: Yes, but with actor-specific evidence. Humans are reviewed on authentication and role membership, while Bedrock agents must be reviewed on their assumed roles, connected data sources, guardrails, and invocation rights, because those are the controls that define their actual reach.
👉 Read our full editorial: Veza models Bedrock agents as first-class NHIs in one access graph
This post was modified 17 hours ago by NHI Mgmt Group