A valid login should not give an AI agent unrestricted access to every connected tool. AWS has published an implementation pattern that applies authorization to each Model Context Protocol request made through Amazon Quick, including checks on the requested tool and its parameters.
Model Context Protocol, or MCP, gives agents a standard way to call databases, applications and APIs. In the AWS design, Microsoft Entra ID supplies identity claims in a signed token. An interceptor attached to Amazon Bedrock AgentCore Gateway evaluates those claims before forwarding a tool call.
The walkthrough uses four gates: multifactor-authentication status, geographic restrictions, group-to-role mapping and tool-level permissions. Role and tool checks are always active in the sample, while the other gates can be enabled according to compliance needs. A fictional risk-register application demonstrates the distinction between readers and administrators, as well as immutable audit records for changes.
The architecture is an AWS reference implementation rather than a newly managed security guarantee. Teams still have to configure identity claims, permissions and the interceptor correctly. Its important design principle applies beyond one cloud: authentication establishes who issued a request, while a separate server-side decision must determine what that identity may do. Agent instructions alone are not an authorization boundary.