Treat each Bedrock agent as a first-class non-human identity and review the role it assumes, the tools it can invoke, and the people who can manage it. Governance should cover inventory, ownership, access certification, and blast-radius assessment together, because the agent’s effective permissions come from delegation, not from the model alone.
Why This Matters for Security Teams
amazon bedrock agents should be governed as identities because they do not just generate outputs, they act. An agent can assume a role, call tools, chain prompts, and interact with data systems in ways that create real blast radius. Treating the model as the control point misses the operational reality: the permissions are delegated, the actions are runtime-driven, and the risk is shaped by what the agent can reach.
This is why static IAM reviews are not enough for agentic workloads. Security teams need to know which agent exists, who owns it, what it can invoke, and which human admins can change its behavior. That is aligned with the direction of the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework, both of which emphasize runtime risk, accountability, and system-level governance rather than model-only review. NHIMG research also shows that 97% of NHIs carry excessive privileges, which is exactly the kind of condition that turns an agent from a productivity asset into a high-impact trust boundary.
In practice, many security teams encounter agent overreach only after a tool call or data access event has already widened the blast radius, rather than through intentional pre-deployment governance.
How It Works in Practice
Governing a Bedrock agent as an NHI starts with inventory and ownership. Each agent should have a unique identity record, a named business owner, a technical custodian, and a documented purpose. From there, security teams should map the agent’s execution role, the downstream AWS services it can call, and any external tools or data sources it can reach. That mapping becomes the basis for access certification, not a separate paperwork exercise.
The control model should focus on delegated authority. An agent may use an IAM role, but the effective identity is broader than the role alone because the agent can decide when to invoke tools. Current guidance suggests pairing least privilege with short-lived delegation: time-bound credentials, constrained session scope, and explicit revocation when the task ends. Where possible, use workload identity signals and runtime policy checks so the agent is authorised based on the action it is attempting, not only on a static role assignment.
- Inventory the agent, its prompt assets, and its tool inventory as one object.
- Restrict the IAM role to the smallest service set and data scope needed.
- Require human approval for changes to tools, prompts, or permission boundaries.
- Log every tool invocation, role assumption, and cross-system data access.
- Review the agent’s blast radius after each material workflow or policy change.
NHIMG’s Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into service accounts, which is a useful warning sign for agent governance: if the identity inventory is weak, agent oversight will be weaker. Security teams should also study the patterns described in the OWASP NHI Top 10 and the CSA MAESTRO agentic AI threat modeling framework when defining guardrails for tool use, escalation paths, and containment. These controls tend to break down when an agent is allowed to dynamically discover tools in a loosely governed environment because the effective permission set grows faster than the approved inventory.
Common Variations and Edge Cases
Tighter governance often increases operational overhead, so organisations have to balance speed against containment. That tradeoff becomes sharper when agents are used for experimentation, support, or developer productivity, where teams want fast iteration but still need auditable authority boundaries.
One edge case is multi-agent orchestration. When one agent delegates to another, ownership and accountability can blur quickly. Best practice is evolving, but current guidance suggests treating each agent as a separate identity with its own approval path, even when they share a broader workflow. Another edge case is high-churn environments where prompts, tools, and connectors change frequently. In those settings, periodic reviews are too slow, and runtime policy evaluation becomes more important than pre-approved static entitlements.
Security teams should also distinguish between the model provider and the agent operator. A managed model service may be low risk, while the agent built on top of it may still have broad access to internal systems. That distinction matters because the highest-risk failures usually come from delegated tool access, not from the model weights themselves. For a wider research context, NHIMG’s analysis of the Moltbook AI agent keys breach and the CoPhish OAuth Token Theft via Copilot Studio show how quickly delegated access can be abused once an agent boundary is too permissive.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Agent tool abuse and over-delegation are central to Bedrock agent governance. |
| CSA MAESTRO | M1 | MAESTRO maps directly to threat modeling and control design for agent workflows. |
| NIST AI RMF | AI RMF fits governance, accountability, and lifecycle oversight for autonomous agents. | |
| OWASP Non-Human Identity Top 10 | NHI-01 | Bedrock agents are non-human identities that require inventory and lifecycle control. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access and certification are core to agent identity governance. |
Model each Bedrock agent workflow, then enforce controls for delegation, tools, and approval.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
