How Axonius built secure multi-tenant AI agents on Bedrock AgentCore
Axonius adopted a hybrid multi-tenancy architecture for AI agents on Amazon Bedrock AgentCore, combining a shared runtime with infrastructure-level tenant enforcement at the tool layer via AgentCore Gateway The platform supports three deployment patterns—silo, pool, and bridge—each offering different trade-offs between isolation, cost, and operational complexity Tenant isolation is enforced through JWT-based authentication with custom tenant claims, enabling secure routing of tool calls and data
Analysis
TL;DR
- Axonius adopted a hybrid multi-tenancy architecture for AI agents on Amazon Bedrock AgentCore, combining a shared runtime with infrastructure-level tenant enforcement at the tool layer via AgentCore Gateway
- The platform supports three deployment patterns—silo, pool, and bridge—each offering different trade-offs between isolation, cost, and operational complexity
- Tenant isolation is enforced through JWT-based authentication with custom tenant claims, enabling secure routing of tool calls and data access per customer
- Key requirements addressed include strict tenant data scoping, identity integration with existing AWS Cognito/EC2 auth modules, per-tenant cost tracking, API integration, CI/CD lifecycle management, and fleet-scale observability
- The hybrid approach eliminates application-dependent isolation risks while preserving operational simplicity of a single shared runtime deployment
Why It Matters
This case study provides a practical blueprint for ISVs and SaaS providers looking to integrate AI agents into multi-tenant environments without compromising security or isolation guarantees. It demonstrates how AWS Bedrock AgentCore's architecture can reconcile the tension between operational efficiency (shared resources) and enterprise-grade tenant separation (dedicated enforcement), which is a critical concern for any organization handling sensitive customer data at scale.
Technical Details
- Three multi-tenancy patterns: The silo model uses dedicated agents per tenant with full infrastructure isolation; the pool model shares a single runtime across tenants with session-level isolation via unique session IDs; the bridge/hybrid model combines a shared AgentCore runtime with per-tenant enforcement at the tool layer through AgentCore Gateway
- JWT-based tenant routing: Tenants authenticate through OAuth 2.0 (e.g., Amazon Cognito), with JWTs carrying a
custom:tenant_idclaim. AgentCore's built-in JWT authorizer validates tokens via a configured discovery URL, and agent code routes tool calls and data access based on the tenant claim - MicroVM-level isolation: AgentCore runtime allocates a dedicated microVM for each session, providing structural separation while serving multiple tenants from a single runtime instance
- Integration requirements: Axonius maintained its existing silo deployment model (dedicated Amazon VPC per customer with ALB, NLB, databases, and EC2 compute), requiring the agent identity flow to integrate seamlessly with its existing authentication and authorization module without disruption
- Operational concerns addressed: Per-tenant cost tracking (critical since model invocation drives most agentic costs), observability for large agent fleets with tracing and alerting, and inclusion of agentic workloads into existing silo Continuous Delivery pipelines
Industry Insight
- ISVs should carefully evaluate the hybrid (bridge) model when balancing onboarding speed against security requirements—it enables rapid customer onboarding without infrastructure provisioning while still enforcing tenant boundaries at the infrastructure layer, not just in application code
- Per-tenant cost tracking must be baked into agentic architecture from the start, as model invocation costs can escalate unpredictably and directly impact pricing strategy for AI-powered SaaS offerings
- Platform engineers should prioritize observability and lifecycle management early in agent deployment; managing large fleets of per-tenant agents requires robust tracing, alerting, and CI/CD integration to avoid operational blind spots as the tenant base scales
Disclaimer: The above content is generated by AI and is for reference only.