If you sell an agent product, you serve many customers (tenants) on shared AWS, and customer A must never see customer B's data or spend their budget. The core decision is how much to isolate per tenant versus share. AgentCore gives you three patterns and the building blocks to enforce them.
New to these words? Read chapter 02 "Key terms" (session, microVM, namespace, IAM). Architecture choices: chapter 31.Multi-tenant means one platform serving many separate customers. Each tenant's data, tools, memory, and costs must stay walled off from the others. The design is a dial: full isolation per tenant (safe, costly) at one end, shared everything (cheap, careful) at the other.
Each session runs in its own microVM, so one tenant's run cannot touch another's.
Hierarchical namespaces (tenant / user / session); filter by prefix, e.g. tenant_123:user_456.
Tenant context travels in request headers (id, tier, data prefix); a JWT rule allows only if tenant_id matches.
Agents act on behalf of a user with scope-limited credentials, never full impersonation.
Tag every resource with the tenant id. Track token usage per tenant and infrastructure cost through AWS Cost Explorer cost-allocation tags, so you can bill accurately, enforce per-tenant budgets, and spot a noisy tenant before it hurts the others.