In our conversations with customers over the past months, one pattern keeps recurring. Whether they work with coding agents, autonomous agents, or human-interactive ones, and regardless of workload maturity, we start with the same question: “Which AI agents have access to customer data, who granted it, and what would exposure look like if a credential leaked today?” If nobody in your organization can answer that in under a minute, this post is for you.

When AI agents connect to internal tools without centralized governance, organizations encounter access risks that are difficult to detect. Consider an infrastructure engineer opening a teammate’s laptop to debug a build. In the config folder sits a file named mcp.json containing a production database password in plain text, next to a comment that reads TODO: rotate this. The security team has no visibility into which AI agents are reaching internal tools, who granted the access, or what the exposure would be if that credential were inadvertently exposed.

The proposed solution uses Model Context Protocol (MCP)-enabled assistants, including IDE helpers like Kiro, Claude Code, Cursor, and AI tools like Amazon Quick. This post focuses on the AWS managed service Amazon Bedrock AgentCore, a platform to build, connect, and optimize agents at scale with any framework or model. With AgentCore Gateway (a capability of Amazon Bedrock AgentCore), you provide a single, secure entry point to your organizational tools for agentic traffic. It relies on AgentCore Identity (a capability of Amazon Bedrock AgentCore) for secure authentication, authorization, and credential management. To define and enforce security controls for AI agent interactions with tools, you use AgentCore Policy. You can then augment the policy with safety and privacy controls using Amazon Bedrock Guardrails, and build a centralized catalog for organizing, curating, and discovering tools using AWS Agent Registry. Self-hosted options (Kong Gateway, Open Policy Agent, NeMo Guardrails, and LangFuse) also exist, and this post calls them out where relevant.