By leveraging the AgentCore Gateway as a Model Context Protocol server, organizations can now execute AI-driven actions in ServiceNow without obscuring the original user’s identity. This technological breakthrough marks a significant shift in how enterprise systems manage delegated authority within autonomous workflows. Traditionally, AI agents operated under broad, generic service accounts, which often created a “black box” effect where specific user actions were indistinguishable from system processes. In the current landscape of 2026, where security auditing and regulatory compliance are at the forefront of operational strategy, such anonymity is no longer acceptable for high-stakes environments. By utilizing the integration between AWS Bedrock and ServiceNow, organizations can ensure that every automated interaction is cryptographically tied to a legitimate user session. This capability strengthens the security posture by enforcing user-specific permissions and providing a granular audit log that simplifies compliance reporting and incident response.
1. Establishing Identity Foundations and Inbound OAuth Settings
Establishing a secure identity framework begins with the creation of two separate application registrations within Microsoft Entra ID, forming the bedrock of the on-behalf-of authentication flow. The initial registration serves as the dedicated ServiceNow API connector and must be configured to expose an API scope specifically named user_impersonation, which is the functional key that allows the identity swap to occur. This scope defines the permissions that the platform can request when acting for a human user, ensuring that the delegation is explicitly authorized within the identity provider. Simultaneously, a second application registration is created for the AI agent itself, which necessitates the generation of a client secret that the AgentCore Gateway will use to authenticate its own requests. By granting the agent application the specific permission to call the ServiceNow connector, administrators build a verified pathway that restricts access to only those entities that have been formally introduced within the environment.
Once the identity provider is configured, the focus moves to the ServiceNow instance where inbound OAuth settings must be established to recognize and validate these external tokens. This process involves navigating to the System OAuth module to create an inbound integration registry entry that utilizes the Client ID from the previously registered ServiceNow API connector in Entra. A critical component of this setup is the implementation of an OpenID Connect provider configuration, which points the ServiceNow environment to the Microsoft Entra tenant’s metadata URL for real-time authentication. During this phase, administrators must map specific user claims—such as the preferred_username—to the corresponding identity fields within the local ServiceNow user table. This mapping is essential because it allows the system to identify exactly which internal employee profile is associated with the incoming token, enabling the platform to apply existing role-based access rules and data restrictions to the agent’s actions automatically.
2. Defining Authorization Scopes and Initializing the Gateway
To further refine security, developers define specific authorization scopes within ServiceNow that limit the AI agent’s reach to only the most necessary functions, such as the Table API. This approach ensures that even with a verified user identity, the agent cannot move laterally into unauthorized system areas or access sensitive records beyond its intended operational mandate. Following this, the configuration shifts to the Amazon Bedrock AgentCore console, where an outbound authentication profile is created to manage the secure egress of user credentials. By entering the AI agent’s client ID, its secret, and the standard Entra discovery URL, the system is prepared to utilize a JWT authorization grant for the exchange process. This outbound configuration acts as the secure intermediary, holding the necessary credentials to initiate the token swap while ensuring that the actual transfer of identity remains encrypted and compliant with modern security standards for enterprise-grade generative AI applications.
The initialization of the AgentCore Gateway requires the use of the Model Context Protocol (MCP) version 2025-11-25 or later, as these specific iterations provide the native architectural support required for advanced token delegation. Older versions of the protocol do not possess the internal logic necessary to handle the complex on-behalf-of flow, which requires the gateway to manage multiple nested identity claims simultaneously. When the gateway is deployed, its inbound identity must be configured using the AI agent’s application registration details, effectively creating a persistent link between the AWS environment and the Microsoft Entra identity provider. This technical binding ensures that every request passing through the gateway is pre-vetted against the organization’s primary identity source before any external API calls are attempted. By standardizing on these modern MCP versions, organizations future-proof their AI deployments and ensure they remain compatible with evolving security patches and identity standards within the AWS ecosystem.
3. Connecting Target Endpoints and Finalizing Token Exchange
Connecting the ServiceNow target to the gateway involves providing the specific REST endpoint for the instance along with a detailed OpenAPI specification that describes the available functions and data models. Within the target’s advanced configuration settings, the outbound identity provider is set to use the previously established OAuth profile, effectively bridging the gap between the gateway and the external service. The final step in this configuration is the activation of the token exchange grant, where the administrator inputs the scope for the ServiceNow API connector and adds the essential custom parameter: requested_token_use: on_behalf_of. This parameter is the critical command that instructs Microsoft Entra ID to perform the identity swap, generating a new token that is scoped for ServiceNow while retaining the original user’s identity claims. This mechanism allows the AI agent to present a credential that the target system recognizes as a legitimate, user-initiated request rather than an unauthorized system-level call.
The integration process reached its successful conclusion as the gateway began transparently managing the complex token exchanges for every automated request directed toward the ServiceNow platform. During the verification phase, technical teams monitored the flow of traffic and confirmed that the gateway received the agent’s token, swapped it for a user-scoped credential, and forwarded the request without requiring custom code modifications. This automation ensured that the end-user’s identity remained intact throughout the entire lifecycle of the AI interaction, resulting in accurate and detailed audit logs within the ServiceNow system. Organizations that implemented this strategy found they could confidently scale their AI agent deployments while maintaining strict adherence to internal security policies. Moving forward, these teams prioritized regular audits of user claim mappings and refined API permissions to eliminate potential vulnerabilities. This approach established a sustainable framework for secure identity management in an increasingly autonomous enterprise landscape.
