AWS and Okta document per-user delegation for enterprise agents
AWS published a two-part AgentCore pattern using Okta Cross App Access to bind an agent to a signed-in user, exchange short-lived grants and enforce tool policy through AgentCore Gateway and Cedar. In AWS's test setup, removing a user stopped new grants in about one second while issued tokens lasted up to five minutes.
Why it matters: The pattern replaces shared agent service accounts with explicit user-and-agent identity and a measurable revocation window. It also shows that different target applications can have different consent and revocation behavior, so one identity design cannot be…