Identity that survives the second hop: OBO token exchange from AgentCore Gateway to Artifactory

Hop 1 was never the hard part. The user signs in with an identity provider, the agent presents that identity, and the Gateway validates the JWT on the way in ^[5][9]. The per-user security model for agent traffic therefore reduces to one leg of a two-leg path ^[14]: whichever credential the Gateway holds when it turns round and calls Artifactory ^[8].

JFrog is unusually direct about what a single shared credential costs at that boundary. Actions land in the log against one service account rather than the person who triggered them [c10a]. That credential normally carries broader access than any individual user, so the agent can act beyond the permissions of the person asking [c10b]. And one long-lived secret, once leaked, exposes everything the agent can reach [c10c].

What on-behalf-of exchange changes is where the permission decision gets made. AgentCore Identity, the managed broker and vault behind outbound auth, performs the exchange so the outbound call carries the user rather than a shared identity ^[6]. Artifactory then evaluates the request with its own authorization system against the signed-in person, and accountability for the operation stays with that person ^[13].

The alternatives listed alongside it are worth reading for where each one parks the trust. Header whitelisting forwards identity in a request header that the target must be set up to trust ^[12], which makes the guarantee a configuration promise on the receiving end rather than a signature the receiver can check. Three-legged OAuth is the other option named, and these are general Gateway mechanisms rather than anything JFrog-specific ^[11].

Two limits on the evidence. This is JFrog's own write-up of an integration with an AWS service ^[15], and it is a procedure rather than an assessment: it asserts the request reaches Artifactory as the user and hands over the CLI steps to reproduce it ^[2]. It also only covers traffic that actually goes through the Gateway, which is the single place targets are registered and outbound credentials are obtained ^[3][5]. Targets can be Lambda functions, OpenAPI or Smithy APIs, or other MCP servers ^[4], and the identity story holds for exactly as many of them as are registered there.

Agents already open pull requests, run queries, and publish artifacts into repositories ^[1], which means the question of who published a given build is going to be asked. A shared service account answers it with the name of a robot. This answers it with a person ^[13].