Enterprise identity on Amazon Bedrock AgentCore with Lark (Feishu) as the IdP. Every turn arrives as a signed per-user JWT, and that user's Lark token lives in the AgentCore Identity Token Vault (OAuth 3LO) — stored and refreshed natively, no self-managed store. MCP tools act as the user against Lark, reaching only what that user can. - View it on GitHub