Building multi-tenant agents with Amazon Bedrock AgentCore

TL;DR

• Amazon Bedrock AgentCore is a managed, serverless service specifically designed to simplify the deployment of multi-tenant agentic applications by providing built-in support for identity, memory, observability, and evaluations.
• The service introduces session-isolated microVM-based compute, which allows each tenant session to have its own persistent file system, effectively preventing cross-session data leakage without the overhead of full virtual machines.
• Architectural design for multi-tenancy revolves around three core isolation patterns: Silo (dedicated resources), Pool (shared resources), and Bridge (hybrid shared infrastructure with tenant-specific logic), requiring tiering strategies to balance cost and security.
• Tenant context is propagated via custom HTTP headers containing metadata such as tenant identifiers, feature flags, and entitlements, enabling agents to dynamically adjust workflows and access licensed tools without hardcoded routing.
• Model strategy options range from shared foundation models for streamlined operations to tenant-specific fine-tuned models for compliance and performance SLAs, with a hybrid approach recommended for balancing cost and customization.

Why It Matters

This article addresses the critical gap between proof-of-concept AI agents and production-ready SaaS deployments, highlighting that security and isolation are primary blockers for enterprise adoption. For AI practitioners, it provides a concrete framework for implementing multi-tenancy that balances the high security requirements of enterprise clients with the operational efficiency needed for scalable SaaS models. The emphasis on microVMs and header-based context propagation offers actionable architectural patterns for building secure, isolated agent infrastructure on AWS.

Key Data

• Compute Mechanism: Session-isolated microVMs launched on a per-session basis, avoiding the cost and latency of full virtual machines.
• Data Isolation Feature: Each session carries its own persistent file system for reading/writing session-scoped files and maintaining intermediate computation artifacts.
• Context Propagation Method: Tenant-specific metadata (identifiers, tiers, regional preferences, feature flags) is attached via custom HTTP headers alongside standard authorization tokens.
• Architectural Patterns: Three primary tenant isolation patterns are defined: Silo, Pool, and Bridge.
• Integration Protocols: The architecture is explicitly noted as suitable for hosting multi-tenant MCP servers, agents, and AG-UI servers.

Technical Details

• MicroVM Isolation: AgentCore Runtime utilizes lightweight microVMs for each session rather than container-only or full-VM approaches. This design isolates the execution environment and file system per session, mitigating noisy neighbor effects and ensuring data isolation between concurrent tenant interactions.
• Context-Aware Execution: Agents interpret custom HTTP headers at invocation time to establish tenant awareness. This allows the runtime to dynamically route requests to specific tenant APIs, enforce feature flags, and restrict tool usage based on the tenant's license entitlements without requiring code changes for each tenant.
• Model Tiering Strategy: The system supports a spectrum of model configurations: shared foundation models for standard operations, tier-specific model selection for balancing cost/performance, and fine-tuned models (via Amazon Bedrock fine-tuning or Custom Model Import) for tenants requiring specialized terminology or regulatory compliance.
• Workflow Management Patterns: The architecture supports three workflow implementation patterns: Silo (isolated skills per tenant), Pool (shared skills for all tenants), and Bridge (shared infrastructure skills that invoke tenant-specific skills at runtime). The Bridge pattern is highlighted for enabling reusable infrastructure while maintaining tenant-specific business logic.

Industry Insight

• Shift to Infrastructure-Native Security: The move from container-based isolation to microVM-based session isolation signals that the industry is treating agent state and data leakage as a first-class security concern, moving beyond standard API security to hardware-virtualized isolation for stateful AI workloads.
• Standardization of Agent Protocols: The explicit mention of MCP (Model Context Protocol) and AG-UI servers suggests that multi-tenant agent platforms are converging on these open standards for interoperability, reducing vendor lock-in risks for SaaS providers building on AgentCore.
• Cost-Performance Arbitrage: The recommended hybrid model strategy (shared for standard, fine-tuned for premium) indicates that monetization of agentic SaaS will increasingly rely on serving high-value enterprise clients with customized, compliant models while absorbing costs for broader tiers through shared infrastructure.

zon Bedrock AgentCore handle the "noisy neighbor" problem in multi-tenant environments?
A: It employs session-isolated microVM-based compute, where each session runs in a lightweight virtual machine with its own persistent file system, ensuring that resource consumption or data access from one tenant does not impact or leak to another.

Q: What is the difference between the Silo and Bridge patterns for workflow management?
A: The Silo pattern embeds the entire tenant workflow, including business logic and validation, into isolated agent skills, offering maximum independence but higher maintenance costs. The Bridge pattern shares common workflow steps (like logging and auth) in shared skills and only invokes tenant-specific skills for business-critical logic, balancing reusability with customization.

Q: Can SaaS providers use their own pre-trained models with AgentCore?
A: Yes, Amazon Bedrock Custom Model Import allows providers to bring their own fine-tuned models and deploy them using AWS managed infrastructure, enabling specialized performance or compliance features for specific tenant tiers.