A company builds an agentic assistant that reads calendars, files tickets, and queries HR data on behalf of 5,000 employees. A shared service role with broad access failed least-privilege review and long-lived keys were found in code. Which access control design for agentic AI apps using AgentCore Identity enforces secure delegation?

The correct design succeeds because AgentCore Identity uses OAuth token exchange to carry the individual employee identity into each invocation and vends short-lived credentials scoped to that single calendar, ticketing, or HR action, preserving user context for authorization and audit at 5,000-user scale while enforcing least privilege and removing the failed shared role and embedded keys. The session-scoped variant fails on authorization granularity because reusing one credential across multiple calls lets permissions accumulate so calendar read context can bleed into ticketing or HR access, violating the per-action scope mandate. The workload-bound variant fails on identity propagation because scoping to the agent service identity instead of the invoking user recreates the shared-role problem and blocks per-user policy enforcement, consent, and attribution. The direct-vending variant fails on delegation protocol because bypassing OAuth exchange for local credential issuance breaks verifiable user-to-agent delegation and weakens federation, validation, and revocation with enterprise identity providers. Exam caveat is to compare each familiar pattern against every stem constraint rather than selecting any secure-sounding design, paying close attention to user versus agent subject, session versus per-action scope, and whether OAuth exchange is present. Practical check is to trace a live tool call in logs to verify it shows the employee subject, minimal action-specific scope, and minutes-level expiry with no static keys in code or environment.