Enterprise AI Assistants Need Identity Boundaries

Enterprise AI assistants are becoming a shared interface for internal portals, documentation, and APIs. Dutch retailer HEMA shows with HAL how MCP and Amazon Bedrock AgentCore can unify knowledge without placing AWS credentials on employee devices.

One interface does not replace authorization

According to AWS, HEMA already maintained a structured service catalog and technical documentation. The answers were distributed across wikis, service catalogs, and IT portals. HAL exposes these sources through Amazon Bedrock Knowledge Bases, OpenAPI interfaces, and MCP tools in chat, Kiro, Claude, and other clients.

The critical architectural decision is not the chat interface. Security is anchored in Microsoft Entra ID. External MCP clients authenticate through a separate gateway; the knowledge sources currently exposed are read-only, and access follows existing Active Directory groups. HEMA also separates the internal IAM-protected agent gateway from the external MCP surface.

Identity must reach the downstream tool

Microsoft describes the OAuth 2.0 On-Behalf-Of flow for this chain. An application receives a delegated user token and exchanges it for a token accepted by a downstream API. The next service therefore continues to operate in the signed-in person’s context. Application roles without user context are not intended for this flow.

For internal assistants, this is an important boundary. A shared service account may simplify integration, but it concentrates privileges and makes three questions harder to answer: Who initiated the access? Which permission applied? Which source or action was actually allowed?

What DACH companies should verify before enabling actions

HEMA currently operates HAL as a read layer and plans to add actions such as requesting an AWS account later. That sequence matters: the answer architecture earns the write step.

Before an assistant executes business processes, companies should at least:

• propagate the user’s identity to the target system,
• authorize read and write tools separately,
• enforce scopes and groups in the source system,
• log the user, tool, resource, and result,
• protect sensitive actions with confirmation or additional approval.

Delegated identity does not automatically resolve privacy, purpose limitation, or retention requirements. It does create the technical foundation for least privilege and accountable decisions. A production assistant should therefore not see everything by default. It should see and do only what the current user is permitted to access for the specific task.