# AWS shows how to govern AI agent access with Okta and AgentCore Identity

> Original title: Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 1

- Source: AWS Machine Learning Blog
- Published: 2026-11-06T17:09:18.000Z
- Bad Influence: https://badinfluence.news/items/o1jtev65h74iud9fsefw2kbqw
- Original: https://aws.amazon.com/blogs/machine-learning/govern-ai-agent-access-with-okta-cross-app-access-and-amazon-bedrock-agentcore-part-1/

## Summary

AWS explains how to build a task agent on Amazon Bedrock AgentCore runtime that acts for signed-in users through Okta Cross App Access and AgentCore Identity. The post reports that after an administrator removed a user's assignment to the agent, Okta refused new requests within about 1 second, and issued tokens expired within 5 minutes. AWS says AgentCore Identity added about 0.6 seconds to a request that took about 30 seconds end to end. The sample code is for non-production use.

## Why it matters

The post shows how Okta decisions and AgentCore Identity tokens work together, with measured revocation timing and the checks each tool performs.