AWS Partner Network (APN) Blog

Governing AI agent identity with Amazon Bedrock AgentCore and Saviynt Zuma

By: John Brunot, Partner Solutions Architect – AWS
By: Suresh Sridharan, VP of Product Management – Saviynt

Saviynt Logo
Saviynt
Saviynt Connect Button

This post shows how to govern AI agent identity across its lifecycle by combining Amazon Bedrock AgentCore with Saviynt Zuma. Across many enterprises, AI agents now route inquiries, summarize documents, query data stores, and call downstream APIs with limited human oversight. Each agent authenticates to systems, holds permissions, and acts on data. This means each one needs governance, just like the human identities in their environment. Most organizations, however, manage agents as application components rather than as governed identities. As a result, security teams cannot answer basic questions: which agents exist, who owns them, what they can access, and whether that access remains appropriate.

Amazon Bedrock AgentCore is an agentic service for building, deploying, and operating agents securely at scale. To support these agents in operating within defined guidelines, Saviynt Zuma adds a governance layer that spans discovery, ownership, runtime authorization, access certification, and lifecycle management. Zuma works with AgentCore to deliver this governance across an agent’s complete lifecycle.

Why agent identities need governance

An agent can be created in seconds, invoke a large and changing set of tools, and autonomously act on behalf of a human user, or delegate actions to another agent. Delegation chains and dynamic tool selection add complexity. Compared with traditional service accounts, they make it harder to reconstruct why an agent took a given action. Two significant issues arise with agents. First, coarse-grained permissions describe what an agent can do at design time, not what it should do in a specific request context. Second, without a registry that records each agent’s owner, purpose, and scope at creation, organizations cannot reliably run access reviews or produce an audit trail. Frameworks such as the EU AI Act, the Digital Operational Resilience Act (DORA), and the Network and Information Security Directive (NIS2) impose risk-management, access-control, and logging duties. These duties apply to autonomous systems by the function they perform. An agent registry supports the inventory, accountability, and audit expectations these frameworks set. Consult your legal and compliance teams to determine which requirements apply to your workloads.

You can address these issues by governing agents as first-class identities, which establishes accountability at creation, enforces least privilege at runtime, and produces the records audits require.

Solution overview

The integration addresses two concerns: the runtime that executes agents and brokers their access, and the governance control plane that manages agent identities over time.

AgentCore includes the following services as part of Amazon Bedrock AgentCore (each can be used independently or together):

Saviynt Zuma provides the governance control plane through three components:

  • Discovery: Identifies, on an ongoing basis, AI agents as the central governed entity across AgentCore and other environments. For each agent, it captures the defining metadata: the large language model (LLM) it uses, the MCP servers and tools it connects to, its owner, permissions, and lifecycle state.
  • Protect: Evaluates each agent action at runtime against identity, context, policy, and intent. Distinguishes whether the agent acts independently, on behalf of a user, or through delegation, and enforces least privilege based on that distinction.
  • Management: Applies ownership rules, lifecycle controls, access certification campaigns, and policy enforcement. Produces audit evidence spanning the full identity lifecycle from registration through deprovisioning.

The following diagram shows how AgentCore and Zuma interact across a single agent request, from tool call through governance evaluation.

Figure 1 – Request flow architecture of the integration

Figure 1 – Request flow architecture of the integration

In this model, AgentCore provides execution, credential brokering, tool connectivity, deterministic policy enforcement at the gateway, and telemetry. Zuma adds the cross-environment identity lifecycle: ownership, intent evaluation, certification, and audit evidence spanning agents on AgentCore and in other environments. Where the layers meet, Policy in AgentCore enforces what a tool call is allowed to do, and Zuma governs whether the identity making it is still accountable, owned, and appropriately entitled.

Managing the agent identity lifecycle

The combined architecture manages an agent through six stages.

1. Registration

When you deploy an agent to AgentCore, Zuma records it in a governed inventory. The connector path discovers deployed agents and registers them through a guided workflow. The API path registers agents directly from a continuous integration and continuous delivery (CI/CD) pipeline and captures owner, purpose, and scope at build time. Either path produces an inventory entry with a named owner.

AgentCore maintains its own agent identity directory and, through AWS Agent Registry, a governed catalog of agents and tools. Zuma enhances that inventory with business ownership, entitlement history, and review state across environments.

2. Provisioning

You grant the agent its entitlements. AgentCore Identity brokers credentials and AgentCore Gateway defines the tools the agent can reach. Zuma records granted access so that later reviews can compare it to actual use.

3. Runtime authorization

Policy in AgentCore enforces deterministic rules, written in Cedar or natural language, that define what each tool call can do. Zuma adds an identity-aware check through a standalone authorization service. Before an agent acts, the service confirms that the agent is registered and its owner is current. It also checks that the agent’s access has been certified and that the request aligns with its approved purpose. Policy in AgentCore controls what a tool call can do; Zuma governs whether the identity making it is still authorized to act. For example, a sales-operations agent authorized to read customer relationship management (CRM) data can summarize an opportunity but be blocked from exporting records. That action falls outside the request’s approved purpose.

4. Posture monitoring

Zuma regularly evaluates the agent inventory for over-privileged agents, access drift, and policy violations. It draws on agent metadata retrieved through AgentCore APIs to compare granted access against each agent’s registered purpose. This shifts access review from periodic snapshots to nearly continuous assessment.

5. Certification

Because each agent has a registered owner, Zuma routes access reviews to that owner and records the outcome.

6. Deprovisioning

When you retire an agent, Zuma removes its entitlements and records the action, closing the lifecycle and preserving the audit trail.

Observability and audit

AgentCore Observability produces execution-level evidence: traces and metrics for each session. Zuma maintains the complementary governance record (each agent’s registered owner, granted access, and review history) correlated to AgentCore agents using metadata retrieved through AgentCore APIs. AgentCore services support Amazon Virtual Private Cloud (Amazon VPC), AWS PrivateLink, AWS CloudFormation, and resource tagging. These provide private connectivity and reproducible infrastructure. AgentCore is in scope for SOC 2, ISO, and CSA STAR compliance programs. For current status, see AWS Services in Scope by Compliance Program. Under the AWS Shared Responsibility Model, AWS is responsible for security of the cloud, and you remain responsible for governing the agents and access you configure in the cloud.

An illustrative enterprise scenario

In a representative scenario, a global manufacturing company deployed a fleet of AgentCore agents to route inquiries, summarize documents, and generate compliance reports. The team could not enumerate which agents reached which data sources. After applying this architecture, the team registered each agent through the API path, so every agent had an owner from first deployment. Zuma flagged a summarization agent with unused write access, and the team removed it. Zuma also blocked an export action outside the reporting agent’s approved purpose. In this scenario, Zuma identifies over-privileged agents and removes unused standing access, and such access-review cycles could shorten from weeks to days. The result: a governed inventory with least-privilege access and an ongoing audit trail.

Considerations

You should register agents at creation rather than discovering them later; discovery alone will miss agents that never trigger a connector scan. You can use API-based registration in your CI/CD pipeline to capture developer identity and ownership at build time. Treat runtime authorization and design-time permissions as complementary: permissions alone do not constrain an agent to its approved purpose. Use Policy in AgentCore for deterministic, low-latency rules at the gateway, and Zuma for identity-aware, intent-based decisions that draw on governance state.

Conclusion

AI agents are identities. Governing them requires the same disciplines that apply to human users and service accounts. Amazon Bedrock AgentCore supplies the runtime and tool-access controls. Saviynt Zuma supplies the governance control plane. Used together, they let teams deploy agents while keeping each one accountable, least privileged, and auditable.

To learn more, review the Amazon Bedrock AgentCore documentation and Saviynt Zuma, or get started with Saviynt in AWS Marketplace. Discuss the reference architecture with your AWS account team or AWS Partner Solutions Architect to assess how it applies to your environment.

Connect With Saviynt

Saviynt – AWS Partner Spotlight

Saviynt is an AWS Software Path Differentiated Partner and AWS Security Competency Partner that provides a converged, cloud-native Enterprise Identity Cloud for identity governance and administration (IGA), privileged access management (PAM), and cloud security across human, machine, and AI identities. Saviynt Zuma extends that governance to autonomous AI agents.

Contact Saviynt | Partner Overview | AWS Marketplace