AWS's one-minute test for agent access is really a test of where the answer lives

A minute is roughly the time it takes to query a system that already knows. Anything longer means someone is messaging colleagues. In the failure AWS describes, the authoritative record of which agent can reach which backend is a file in a developer's config folder, sitting next to a plaintext production database password and a note to rotate it ^[2]. There are as many authoritative records as there are laptops, and the backend cannot help, because what arrives is a valid credential attached to a well-formed call.

That is the whole reason the framing moves from configuration to identity. A configuration problem is fixed by editing files. The fifty credential sets in AWS's own arithmetic ^[4] are each individually fixable and collectively unfixable, because the work scales with the product of assistants and backends ^[15]: double both and fifty becomes two hundred ^[14]. Brokered identity is fixed once, since "who is calling and under what authority" then has a single place to be answered, and a single place to be logged ^[13].

It matters that the clients here are IDE assistants like Kiro, Claude Code and Cursor ^[12]. Those are installed per developer, which is why shadow IT and credential sprawl appear on the same list of five breakdowns ^[3] rather than as separate stories.

Now the tension inside the post. AWS warns that most teams try to build the complete gateway before allowing any AI use, which takes months and ships the wrong thing ^[6]. Fair enough, but only Scope 1 answers the minute question: single sign-on, centralised credentials, CloudTrail ^[7]. Scope 2 answers a different one, who invoked which tool and when, and it wants Cedar policies, PII redaction and consent flows ^[8]. Read the maturity ladder as a queue and you will buy policy engines before you have an inventory to write policy against.

The sequencing bites hardest on money. Cost opacity is named as one of the five structural failures ^[3], but its remedy, per-tool cost attribution, is parked in Scope 3 alongside the registry and on-premises discovery ^[9], so the finance question waits behind a developer self-service feature ^[16].

And the file on the laptop still works. A single governed entry point governs the traffic that chooses to come through it ^[5]. Until backends refuse credentials the broker did not issue, mcp.json is a functioning bypass that produces no log line, which means the inventory can be complete and wrong at the same time.

The most honest passage is the one listing self-hosted substitutes: Kong Gateway, Open Policy Agent, NeMo Guardrails, LangFuse ^[11]. AWS is describing a control pattern it also sells. The pattern is the part you cannot skip.