Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 2
TL;DR
In Part 1 you built one governed agent. Part 2 scales the pattern to an enterprise: Amazon Bedrock AgentCore Gateway becomes the single front door and redeems Okta's grant, Cedar policies bind each tool to the agent, a second agent runs on Amazon EKS, and AgentCore Observability traces every allow and deny beside Okta's log in Amazon CloudWatch.
Nauti's Take
A small team should first test whether one tool call can be traced end to end, from the Okta grant through the Cedar decision to the CloudWatch record. If that path depends on several services plus EKS, measure the operational burden before standardizing it.
The supplied material consists of two AWS blog entries, so the real-world usability remains independently unverified.
Sources
