AWS Wants One Gatekeeper Between AI Agents and Company Tools

AI assistants that can search tickets, query databases or trigger deployments create a security problem beyond the model prompt: organizations need to know which agent reached which tool, under whose authority, and with what credentials. AWS is pitching Amazon Bedrock AgentCore Gateway as a single governed entry point for that traffic, built around the Model Context Protocol, or MCP.

The immediate target is a familiar deployment pattern: an assistant’s local mcp.json configuration can hold backend credentials and tool endpoints. AWS identifies credential sprawl, policy drift, audit gaps, cost opacity and unreviewed integrations as structural problems in enterprise MCP deployments. Its answer is to put the connection behind a gateway, rather than leave every client to carry its own configuration and secrets.

AWS’s first stage, Connect, is aimed at 1 to 20 pilot users, low-risk tools and emerging shadow MCP use. It pairs a Cognito-backed JWT authorizer with centralized credentials and CloudWatch Logs and CloudTrail auditing. In the proposed setup, an MCP client obtains a token, sends it with tool requests, and the gateway validates the token before routing the call to a registered target; backend credentials remain in AWS.

The second stage, Control, moves from machine-level trust to user-level trust. Dynamic client registration and an authorization-code sign-in flow can put the actual user in the access token’s subject claim. The gateway can then return different tool lists to users in different groups, while AgentCore Policy applies Cedar rules based on identity-provider groups, token claims and request parameters.

The controls AWS layers on after the initial connection

• Tool and parameter authorization: a policy can allow a deployment action only when its environment parameter is staging.
• Data and prompt controls: Bedrock Guardrails can apply personally identifiable information filtering, content policies and prompt-attack detection at the gateway layer.
• Delegated access: when a SaaS target needs a user identity, AgentCore Identity can direct the user through a browser-based consent flow.
• Decision records: AWS says its logs can carry the principal, matched policy ID, guardrail flag and latency for each request.

AWS frames Catalog as the point where teams need to discover and publish tools without tickets, including on-premises tools. Its Agent Registry is the proposed centralized catalog. Harden is intended for deployments past 1,000 users that need private connectivity, governance dashboards, deprecation workflows and multi-Region failover.

The design is explicitly incremental: AWS recommends advancing from Connect through Control, Catalog and Harden only when the next operational pain appears. That leaves enterprises with consequential choices of their own, including who owns the gateway, whether old local mcp.json entries may coexist, how long policies run in log-only mode, and which first deny rule is appropriate. The centralization is the mechanism; the permission model and rollout discipline remain the deployment test.