Enterprise identity on Amazon Bedrock AgentCore with Lark (Feishu) as the IdP. A Gateway Request Interceptor forwards the user's identity and injects a per-user credential — the agent never holds it — so downstream MCP tools act as the user against Lark and reach only what that user can. - View it on GitHub