Enterprise identity on Amazon Bedrock AgentCore with Lark (Feishu) as the IdP. Every turn arrives as a signed per-user JWT, and that user's Lark token lives in the AgentCore Identity Token Vault (OAuth 3LO) — stored and refreshed natively, no self-managed store. MCP tools act as the user against Lark, reaching only what that user can.
-
Updated
Aug 25, 2026 - Python