Topic starter
12/06/2026 9:34 pm
TL;DR: Amazon Bedrock AgentCore covers AWS-native agent identity, but non-AWS agents still depend on AWS credentials and Cognito lacks CIBA, DCR, and out-of-band approval, according to Descope. The governance gap is not agent orchestration itself; it is the absence of a cloud-neutral identity layer that can issue, observe, and revoke access consistently across runtimes.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Build Identity-Aware Agents With Amazon AgentCore and Descope”.
Key questions
Q: How should teams govern identity across multiple cloud platforms?
A: Teams should govern identity across multiple cloud platforms by standardising policy intent, mapping entitlements consistently, and checking that revocation works across every connected system.
Q: Why do non-AWS agents create governance risk even when AWS runtimes are secured?
A: Because the risk is in the identity boundary, not the runtime alone.
Q: What breaks when authorization is decided after the token already exists?
A: The main failure is that privilege can become observable too late to matter.
Practitioner guidance
- Define a cloud-neutral agent directory Inventory every agent across AWS, other clouds, and prototypes in one managed directory with policy, ownership, and revocation data attached to each entry.
- Move authorization to issuance time Require token contents to be decided before an agent can call tools, using user context, tenant, and requested scope as inputs to the policy decision.
- Vault third-party and internal credentials Store OAuth tokens and static API keys outside the agent environment and release them only at call time through a shared credential vault.
Bottom line: Identity-aware agents running across clouds expose a governance gap that cloud-native controls cannot close on their own.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
12/06/2026 11:44 pm
Cloud-neutral agent identity is the real control plane requirement: the article shows that cloud-native agent governance works only inside the ecosystem that issued it. Once agents span AWS and non-AWS runtimes, identity, directory, and policy all need to travel with the workload. Practitioners should treat cloud neutrality as an access governance requirement, not a convenience feature.
A few things that frame the scale:
- Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
A question worth separating out:
Q: Should organisations separate agent runtime controls from identity governance?
A: Yes. Runtime attestation, token injection, and cross-cloud policy serve different purposes, and collapsing them into one control plane makes portability and offboarding harder. Separate layers let each cloud contribute without becoming the only trust boundary.
👉 Read our full editorial: Identity-aware agents need cloud-neutral governance beyond AWS
This post was modified 7 days ago by NHI Mgmt Group