Enterprise identity on Amazon Bedrock AgentCore with Lark (Feishu) as the IdP. Per-user Lark tokens live in the AgentCore Identity Token Vault (OAuth 3LO) — stored, refreshed, and injected natively, no custom interceptor. Downstream MCP tools act as the user against Lark, reaching only what that user can. - View it on GitHub