AWS limits AI agents’ data access, even when manipulated
AWS has detailed an approach for propagating user authorization context through AI agents, allowing access controls to be enforced by infrastructure and downstream services rather than relying on the agent itself.
Customers using Amazon Bedrock AgentCore can build AI agents that pull information from Amazon DynamoDB tables, document repositories, SaaS platforms, and internal knowledge bases to answer questions and automate workflows. Without awareness of the user making a request, however, an agent could return information that the user is not authorized to see.
The following diagram shows the architecture used in this demonstration. (Source: AWS)
“The agent acts as an orchestrator, not a gatekeeper,” AWS explained. “Authorization is enforced by downstream services.”
CRM access control use case
AWS illustrates the approach with a CRM application where employees from Sales and Finance interact with the same AI agent to access customer information.
Sales employees need access to customer contracts, pricing strategies, and sales pipeline data, while Finance employees need access to invoices, payment records, and financial reports.
The agent can retrieve information from Amazon DynamoDB, documents stored in Amazon Bedrock Knowledge Bases, and external services such as Salesforce.
When a Sales employee asks to see customer contracts, for example, the agent should only be able to retrieve information available to the Sales department and not Finance data.
AWS said enforcing these restrictions outside the agent provides protection even if the agent is manipulated through prompt injection or affected by an application bug.
User identity and authorization
Employees first authenticate with their corporate credentials. AWS uses Amazon Cognito as the identity provider in its example, although Microsoft Entra ID and Okta can also be used.
Information about the employee, such as their department, is added to their authentication tokens and carried with requests to the agent.
Amazon Bedrock AgentCore Runtime validates the user’s token and checks their authorization information before allowing the request to reach the agent. Requests from users who do not meet the configured requirements can be rejected before the agent runs.
The authorization context can then be passed on when the agent accesses other services, allowing those services to determine which information the user is permitted to access.
Access controls remain outside the agent
AWS demonstrates the approach across DynamoDB, Amazon Bedrock Knowledge Bases, and Salesforce.
For DynamoDB, access can be restricted to records associated with the user’s department. Salesforce can similarly apply its own sharing rules so that the agent receives only records available to the individual user.
Amazon Bedrock Knowledge Bases uses metadata filtering to limit retrieved documents to the appropriate department. AWS notes that this control operates at the application layer and recommends separate knowledge bases with IAM policies where stricter isolation is required.
The broader goal is to avoid giving an AI agent broad access and trusting it to filter sensitive information correctly. Instead, AWS recommends configuring underlying services to reject unauthorized requests “regardless of what the agent asks for.”
“This way, the agent’s credentials are inherently limited to the requesting user’s permissions, and no amount of prompt manipulation can bypass those boundaries,” authors Anshu Bathla, Prafful Gupta, and Rohit Verma, concluded.