Agent Identity no longer needs standing secrets

AWS has introduced agent identity support for Private Key JWT authentication in Amazon Bedrock AgentCore Identity. The important point is not the token flow alone, but the operating model behind it: agents should be able to call downstream APIs without long-lived client secrets, while signatures and access events remain auditable.

What changes

According to AWS, AgentCore Identity signs JWT client assertions with an asymmetric AWS KMS key. The public key is registered with the identity provider; the private key stays in KMS. Agents can then obtain tokens for machine-to-machine, on-behalf-of and user-delegated flows. AWS names CloudTrail events such as GetWorkloadAccessToken and GetResourceOauth2Token, which make access traceable.

In parallel, the MCP specification from July 28, 2026 moves tool communication closer to standard HTTP operations. According to AWS, AgentCore Gateway supports the new version through UpdateGateway, with per-request version selection, stateless transport, structured tool results and headers such as MCP-Protocol-Version, Mcp-Method and Mcp-Name. This helps gateways, monitoring and rate limits work without parsing JSON-RPC bodies.

Why it matters

For enterprises, agent identity is the point where a chatbot becomes a production system. Once an agent reads tickets, queries customer data, combines production data or triggers workflows, API keys in configuration files are no longer enough.

The new architecture makes the control questions more concrete: Which workload identity does the agent use? Who may create the credential provider? Which claims are signed? Which tool calls must be visible in the SIEM? Which protocol version is approved?

DACH perspective

For DACH companies, this fits well with privacy, audit and supplier governance. The point is not to make every agent more autonomous. The point is to separate identity, consent, key material, tool permissions and logs so that a business process remains explainable later.

A pragmatic starting point is an agent identity profile for every production use case: workload name, allowed APIs, token flow, KMS key, CloudTrail events, MCP version, emergency shutdown and human approval for risky tools.