Multi-Tenant Isolation

The sharing granularity of large-model inference is finer than that of traditional SaaS—not only are compute resources shared, but also intermediate computation results (KV cache) and batch slots.

Isolation testing in continuous integration should include multi-tenant concurrent stress testing, interleaved long-context requests, and abnormal interruption recovery scenarios, with content leakage detection as an assertion condition.

srt addresses high-frequency risks such as privilege escalation caused by agent misoperation or prompt injection, not strongly adversarial multi-tenant isolation.

Multi-tenant isolation must be designed from the first day of architecture.

In AI applications, multi-tenant isolation has three key points: each tenant's vectors in the vector store need namespace or partition isolation; usage tracking must record token consumption per tenant; and the authentication layer must inject tenant identity into every retrieval and generation call.

Insufficient isolation granularity leads to security issues such as unauthorized retrieval and cross-tenant leakage via prompt injection.

Multi-tenant isolation for enterprise-grade Agents involves not only row-level permissions at the database level but also namespace or collection isolation in the vector store, per-tenant injection of tool credentials, tenant prefixes on cache and session keys, and per-tenant archiving of logs and trace data.

Multi-tenant isolation means dividing independent data and execution boundaries for different users or organizations within the same Agent service, with common implementations including logical partitioning by tenant_id, independent keys and tool authorization, vector retrieval namespace restriction, and sandbox process- or container-level isolation.

If isolation is done only at the storage layer while ignoring the policy layer, an agent may still reply to customer B's review in customer A's tone, which is a failure mode more subtle and harder to audit than data leakage.

Multi-tenant isolation requires that the conversation history, tool permissions, and data access scope of each tenant be strictly isolated to prevent data boundary violations or permission penetration.

Bedrock Agent Core builds multi-tenant isolation mechanisms into the platform layer, so developers only need to write agent logic targeting a single user to achieve horizontal scaling.