Secure multi-tenant AI agents with Amazon Bedrock AgentCore resource-based policies

This AWS technical guide shows how a SaaS provider can use AgentCore resource-based policies to centrally manage multi-tenant access: granting cross-account invocation for one tenant and enforcing VPC-only traffic for a HIPAA-regulated tenant. It includes architecture details, example policy statements (allow and explicit deny with aws:SourceVpc), CLI commands to apply and verify policies, and notes on OAuth and policy evaluation.