{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-11T21:27:53.457Z",
  "record_id": "VXI-EXT-TOOL-TRUST-AWS-01-v1",
  "record_kind": "external_reference",
  "title": "AWS MCP: Downstream IAM authority",
  "system": "AWS managed MCP",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Do old MCP-specific deny actions still establish a read-only boundary for an AWS agent?",
  "near_questions": [
    "Can an old MCP deny policy fail to restrict a cloud agent?",
    "Which permissions govern calls through AWS managed MCP?",
    "Do AWS MCP-specific IAM actions still enforce access?",
    "How can a policy distinguish MCP-originated AWS calls?",
    "Does AWS managed MCP support temporary credentials?",
    "Is AWS MCP OAuth the same connection path as a SigV4 proxy?",
    "Does cloud MCP access make service calls read-only?",
    "What should an agent check before changing an AWS resource?",
    "Does this AWS profile cover the local API MCP package?",
    "Can an account role allow more than the intended agent task?",
    "What does a saved AWS authorization review preserve?",
    "Does this profile test my IAM policies?"
  ],
  "supported_claims": [
    {
      "claim": "AWS's current managed MCP documentation says downstream services apply the caller's IAM permissions. It explicitly marks the earlier MCP-specific IAM actions as ineffective and describes condition keys for distinguishing MCP-originated calls. OAuth through AWS Sign-in is also documented alongside the signed-request path. A historical policy name alone does not prove the current connection is restricted.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent tool execution or security testing",
    "Vendor certification, guaranteed safety or no-training assurance"
  ],
  "public_summary": "AWS's current managed MCP documentation says downstream services apply the caller's IAM permissions. It explicitly marks the earlier MCP-specific IAM actions as ineffective and describes condition keys for distinguishing MCP-originated calls. OAuth through AWS Sign-in is also documented alongside the signed-request path. A historical policy name alone does not prove the current connection is restricted.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-VERCEL-01-v1",
    "VXI-EXT-TOOL-TRUST-AZURE-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "AWS MCP downstream IAM authorization",
    "source_url": "https://docs.aws.amazon.com/agent-toolkit/latest/userguide/security_iam_service-with-iam.html",
    "checked_on": "2026-10-11",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-AWS-01-v1",
    "candidate_record_sha256": "0858a1282b2026eb3cf9d448014e8923bc902d8d4f7ca09b682e1fcb68b4ba63",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "AWS's current managed MCP documentation says downstream services apply the caller's IAM permissions. It explicitly marks the earlier MCP-specific IAM actions as ineffective and describes condition keys for distinguishing MCP-originated calls. OAuth through AWS Sign-in is also documented alongside the signed-request path. A historical policy name alone does not prove the current connection is restricted.",
    "required_buyer_context": "AWS's managed MCP service in Agent Toolkit for AWS; not the local AWS API MCP package or Bedrock AgentCore runtime. Effective role/session policies, organization controls, endpoint region and client data handling.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "AWS managed MCP",
      "variant": "AWS's managed MCP service in Agent Toolkit for AWS; not the local AWS API MCP package or Bedrock AgentCore runtime."
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-11",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "AWS operates the managed service covered by these documents.",
        "source_ids": [
          "aws-main",
          "aws-oauth"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Let agents call AWS services through existing IAM identities.",
        "source_ids": [
          "aws-main"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Permitted downstream service reads use the caller's IAM rights.",
        "source_ids": [
          "aws-main"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Downstream service permissions also govern requested mutations; the interface is not inherently read-only.",
        "source_ids": [
          "aws-main"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "SigV4 with AWS credentials, including temporary credentials, and OAuth 2.1 through AWS Sign-in are documented paths.",
        "source_ids": [
          "aws-main",
          "aws-oauth"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "Old MCP-specific actions no longer enforce access; current policies can use MCP-origin condition context keys.",
        "source_ids": [
          "aws-main"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Requests traverse the managed MCP service and AWS APIs; results return to the chosen agent client.",
        "source_ids": [
          "aws-main"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Relying on retired deny actions, selecting the wrong account/role, or granting broad downstream write permissions.",
        "source_ids": [
          "aws-main"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Effective role/session policies, organization controls, endpoint region and client data handling.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Resolve account, role and effective current policy before acting; do not rely on an obsolete MCP deny action.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "aws-main",
        "url": "https://docs.aws.amazon.com/agent-toolkit/latest/userguide/security_iam_service-with-iam.html",
        "final_url": "https://docs.aws.amazon.com/agent-toolkit/latest/userguide/security_iam_service-with-iam.html",
        "title": "AWS MCP downstream IAM authorization",
        "checked_on": "2026-10-11",
        "sha256": "85117c87cfdf1437b1560e345f5a135a30d12b18af439b9f7e82b9c09bf771a8",
        "bytes": 23043
      },
      {
        "source_id": "aws-oauth",
        "url": "https://docs.aws.amazon.com/agent-toolkit/latest/userguide/oauth-authentication.html",
        "final_url": "https://docs.aws.amazon.com/agent-toolkit/latest/userguide/oauth-authentication.html",
        "title": "AWS MCP OAuth authentication",
        "checked_on": "2026-10-11",
        "sha256": "45bf359378786f72ed0be400346d8f8132f3a56b01ca34048e461b4d5bc1dc13",
        "bytes": 32897
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Keep a dated policy-model reference showing why legacy deny statements need rechecking before agent access.",
      "free": "Complete profile, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Recheck IAM model changes, effective role/session restrictions and MCP-origin condition keys before relying on a policy."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-11",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#aws-mcp-iam-authority-trust",
  "machine_readable_record": "/varexis-index/records/aws-mcp-iam-authority-trust.json"
}