AWS limits AI agents’ data access, even when manipulated

AWS has detailed an approach for propagating user authorization context through AI agents, allowing access controls to be enforced by infrastructure and downstream services rather than relying on the agent itself.

Customers using Amazon Bedrock AgentCore can build AI agents that pull information from Amazon DynamoDB tables, document repositories, SaaS platforms, and internal knowledge bases to answer questions and automate workflows. Without awareness of the user making a request, however, an agent could return information that the user is not authorized to see.

The following diagram shows the architecture used in this demonstration. (Source: AWS)

“The agent acts as an orchestrator, not a gatekeeper,” AWS explained. “Authorization is enforced by downstream services.”

CRM access control use case

AWS illustrates the approach with a CRM application where employees from Sales and Finance interact with the same AI agent to access customer information.

Sales employees need access to customer contracts, pricing strategies, and sales pipeline data, while Finance employees need access to invoices, payment records, and financial reports.

The agent can retrieve information from Amazon DynamoDB, documents stored in Amazon Bedrock Knowledge Bases, and external services such as Salesforce.