AWS shows how to centralize AI agent authorization with Okta and AgentCore Gateway
In part 2 of a series, AWS describes an enterprise pattern in which Amazon Bedrock AgentCore Gateway acts as the single entry point for agents and redeems grants issued through Okta Cross App Access. Cedar policies bind each tool to a specific agent, and a second agent runs on Amazon EKS with its own identity and read-only scope. AgentCore Observability and CloudWatch record each allow and deny decision next to Okta’s logs.
AWS Machine Learning BlogOriginally published 1 min
Why it matters
AWS says the approach moves authorization out of each tool server into one place with default-deny behaviour, and keeps token-exchange permissions away from the agent’s execution role. Adding a new agent or tool then does not require rewiring the others. The post is vendor guidance with sample code that AWS says is not for production use without review.
For business & IT
Ask whether each of your agents has its own identity and a deny-by-default tool policy, and whether agent decisions can be queried alongside your identity provider’s logs.
AWS says SageMaker Inference can now split one GPU into hardware-isolated partitions, so each partition runs a different model or a model uses only a fraction of a GPU. It works on P4d (A100), P5 (H100), G7 and G7e instances, with up to seven partitions per GPU, and is configured through two new optional API fields.
In an AWS blog post, Greenlight Financial describes Luna, a tiered multi-agent system on Amazon Bedrock AgentCore that handles the 3,000 to 4,000 security and risk alerts its SOC receives each month. The company says Tier 1 alone resolves 83% of cases autonomously, and over 90% once a Tier 2 reasoning layer is added. It estimates the system saves 900 to 1,800 hours of routine analyst work per month.
According to CIO, Meta has paused indefinitely an update to its business terms of service that would have let it take content from customers’ websites and shifted responsibility for AI errors to them. The terms, revealed October 19, had already been delayed to November 20.
Security researchers at RunSybil say a memory-safety flaw in CPython can let a specially crafted AI model bypass the Jinja templating sandbox and run code on the server that hosts it. They warn that providers letting customers upload their own models could be exposed. The Python Security Response Team acknowledges the bug but disputes that the demonstrated escape is a CPython vulnerability.
InfoWorld
With your permission, we use Google Analytics to understand which stories are read. No advertising, and your data is never sold. Privacy policy