A bank builds a Bedrock support agent that calls payments APIs on behalf of users, must prove each agent action uses a short-lived scoped identity, enforce per-user consent, and audit which credential accessed each tool. Which access control design secures generative AI tool use?

The correct design is right because AgentCore Identity provides the agent a distinct verifiable workload identity and its OAuth credential provider mints a short-lived narrowly scoped token for each payments call after per-user consent, creating an auditable binding of agent, user, scope, time and tool that proves which credential performed each action. Assuming a scoped STS role from the Lambda execution role with CloudTrail logging is standard least privilege with short-lived credentials and audit, but it fails delegated consent because the role represents the service, not an OAuth grant from the specific user on whose behalf payment occurs. Validating Cognito user tokens at API Gateway with user logging is common for authorization and audit, but it fails workload proof for outbound use because it authenticates the user to the API without giving the agent its own distinct scoped credential per downstream call. Granting per-user OAuth consent yet caching one reusable payments token reduces token churn, but it fails short-lived per-action scoping, widening blast radius, weakening revocation, and preventing precise per-call attribution. An exam caveat is that scoped roles, Cognito, or OAuth alone can appear complete, so require all three signals together of workload identity, user consent, and per-call credential audit. A practical check is to sample CloudTrail and provider logs for each tool call and confirm a unique token ID, narrow scope, user subject, minutes-level expiry, and workload identity.