Amazon Cognito adds OAuth 2.0 token exchange so AI agents act with least privilege

Identity is one of the least glamorous but most blocking problems in agent deployment, and AWS just closed a gap. Cognito now implements RFC 8693 token exchange. When an agent calls a downstream service for a user, it no longer has to forward the user's broad original token. Instead it exchanges that token for a new one scoped to the target service and the specific delegation.

The flow works like this. The agent presents the user's token plus its own credentials to Cognito's token endpoint and requests a token for a given audience or scope. Cognito issues a narrower token that records both the user and the acting party, often called the "act" claim. Downstream services can then enforce permissions knowing exactly which agent acts for which user. If an agent is compromised or misbehaves, the blast radius is limited to the scope it was granted.

The release ties into a cluster of agent-infrastructure updates from AWS this week, including the new default AgentCore runtime with Firecracker isolation, Nitro Sandboxes for running model-generated code, and AgentCore Gateway patterns for MCP tools. Together they cover isolation (where the agent runs) and authorization (what it can touch). Okta, Microsoft Entra and Auth0 support token exchange in various forms, so Cognito is catching up to identity specialists while integrating natively with Bedrock.

Adoption depends on downstream services validating exchanged tokens correctly, and many internal APIs simply accept any valid bearer token. Teams will need policy work, not just a Cognito toggle. Watch for AgentCore Identity integrating this exchange by default, and for MCP servers adopting audience-scoped tokens as standard practice.