AgentCore copilot, on behalf of a user

Maya asks the copilot to summarize John Smith's situation and post it to #cs-team. The agent authenticates to Descope STS via authorization_code, then exchanges Maya's JWT for the downstream credentials it needs.

DocsClients ↗Connections ↗Policies ↗

Section 2 · Agent outbound auth

Agents authenticate to Descope and receive scoped tokens. Policies fire at issuance. Downstream credentials are fetched from the Connections Vault — never stored in agent code.

Step 1 — copilot acquires a user JWT via authorization_code; policies enforced at issuance; JWT exchanged for Connections tokens to reach Loan API and HubSpot.

Token acquisition / resource token

Connections token → downstream credential

●portal.northwind.com / accounts / smith-john

Northwind · CSM Workspace

Maya Chen· Senior CSM

Account

John Smith

Member since 2022 · last contact 9 days ago

Current

Active loans: 2
Balance: $248,200
Risk band: Low

Descope Console·Connections / Vault

Stored credentials

0 entries

The copilot hasn't asked for any credentials yet.