# AWS shows AgentCore Gateway performing on-behalf-of token exchange with ServiceNow

> Original title: ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway

- Source: AWS Machine Learning Blog
- Published: 2026-11-03T16:47:40.000Z
- Bad Influence: https://badinfluence.news/items/jdzlwzqwsuiz4zhmbr8vbiivf
- Original: https://aws.amazon.com/blogs/machine-learning/servicenow-on-behalf-of-token-exchange-with-bedrock-agentcore-gateway/

## Summary

AWS Machine Learning Blog describes configuring Amazon Bedrock AgentCore Gateway to perform an on-behalf-of (OBO) token exchange with Microsoft Entra ID, so an AI agent can call the ServiceNow REST API while preserving the calling user's identity. The gateway exchanges the agent's token for one scoped to the ServiceNow API connector on each request, and the post says the pattern applies to other OAuth-protected REST APIs.