نقل الهوية في وكلاء البيانات الذكية الخاضعين للحوكمة

المصطلحات التقنية

تمرير الهوية الموثوق

أسلوب تصميم يسمح بحمل هوية المستخدم عبر حدود الخدمات ليجري تقييم الصلاحيات بناءً عليها.

حوكمة بيانات البحيرة

إدارة سياسات الوصول إلى البيانات في بيئة تجمع خصائص مستودعات وبحيرات البيانات.

حدود الثقة للنموذج

النطاق الذي قد تظهر داخله المدخلات وتعريفات الأدوات والمعطيات أثناء عمل النموذج.

Source facts referenced from Amazon Web Services: https://aws.amazon.com/blogs/security/identity-aware-ai-data-agents-with-aws-lake-formation-and-trusted-identity-propagation. This article is an original Kenzie synthesis and does not reproduce the source article.

Verified source facts used: the AWS Security Blog title and summary describe identity-aware AI data agents, Amazon Bedrock AgentCore, AWS Lake Formation, trusted identity propagation, Lambda-based server-side token exchange, CloudTrail audit recording, IAM Identity Center, OAuth 2.0 token delegation, IAM roles, an OIDC identity provider, and the design concern that a foundation model sits in the propagation chain. Evidence limits: only the supplied RSS title and summary were used; the full post, diagrams, code, policies, deployment steps, and test outputs were not independently reviewed. Claims deliberately not made: no regional applicability, no performance benchmark, no legal compliance conclusion, no vulnerability finding, no statement that all deployments are secure, and no endorsement that the pattern fits every architecture. Added decision reasoning: the brief frames authorization placement, separation of duties, trust-boundary handling, and audit review as enterprise evaluation criteria derived from the supplied facts, without attributing those criteria as source findings. Automated copyright score: 0. Source-overlap ratio: 0.0056. Longest source match: 13 words. Rights basis: trusted syndicated RSS metadata used only for factual, attributed synthesis.