Configuring security connections
Connect AI Control Tower to the platforms where your AI agents run and to your identity provider so that AI agent containment using kill switch protocol can deactivate rogue agents wherever they're hosted.
Key benefits
- Connect AI Control Tower to these platforms that host your AI agents: AWS Bedrock, AWS Bedrock Agent Core, Google Cloud Vertex AI, and ServiceNow Agents. Also, you can use Okta as an identity provider, so containment actions can reach agents no matter where they run.
- Deactivate an AI agent through Deny Resource policies applied directly on the hyperscaler platform, without requiring a separate identity provider connection.
- Add an Okta connection to strengthen containment: when an agent's identity is federated through Okta, deactivating the agent also prevents future tokens from being issued to it.
Security connections and AI agent containment
A security connection authenticates AI Control Tower to the platform or identity provider where an AI agent runs, so that AI agent containment using kill switch protocol can act on that agent. Each connector uses a different authentication model — access key credentials for AWS Bedrock and AWS Bedrock Agent Core, OAuth 2.0 with a JWT Bearer grant for Google Cloud Vertex AI, and an API key for Okta — but every connector ultimately creates a security connector record that appears under the Established connections tab.
Behind the scenes, AI agent containment is enforced differently depending on which connections you have in place:
- On a supported hyperscaler platform (AWS, GCP Vertex AI, and ServiceNow), deactivating an AI agent using kill switch protocol applies a Deny Resource policy directly on that platform. This alone is enough to fully disable the agent.
- If you also add an Okta connection, and the AI agent's identity is federated through Okta (AWS Bedrock, AWS Bedrock Agent Core, and ServiceNow Agents), deactivating the agent additionally prevents future tokens from being assigned to it.