Amazon's AI agents can now call ServiceNow as the signed-in user instead of as a shared service account. The mechanism is Microsoft Entra ID's on-behalf-of (OBO) token exchange, handled by Amazon Bedrock AgentCore Gateway. The pattern matters to anyone running Entra as the identity backbone...
