AgentCore's MicroVM Isolation: How Cohere Health Runs Multi-Tenant Clinical Agents Without Cross-Contamination

Cohere Health needed to digitize clinical policies at scale while maintaining strict tenant isolation in a regulated healthcare environment. Their solution on Amazon Bedrock AgentCore reveals concrete patterns for running multi-tenant agent workloads without cross-contamination.

The architecture centers on three components: AgentCore Runtime for execution isolation, AgentCore Gateway for tool access boundaries, and AgentCore Memory for state separation. The Agent Skills open standard ties it together with version control and human oversight.

The MicroVM Isolation Model

AgentCore Runtime executes each agent in a dedicated MicroVM. This is not containerization. Each MicroVM runs a minimal kernel with its own memory space, network stack, and file system. When Tenant A’s clinical policy agent runs, it cannot see Tenant B’s memory or tool calls.

The isolation boundary sits at the hypervisor level. If an agent attempts to read outside its allocated memory or access unauthorized tools, the hypervisor blocks it before the request reaches shared infrastructure. This matters in healthcare because a single leaked patient identifier can trigger HIPAA violations.

MicroVMs boot in milliseconds, not seconds. AgentCore pre-warms a pool of VMs and assigns them to tenants on demand. When an agent completes its task, the VM is destroyed and its memory scrubbed. No state persists between invocations unless explicitly stored in AgentCore Memory.

Tool Access Through the Gateway

AgentCore Gateway sits between agents and external tools. It enforces authorization at the API level. Each agent receives a scoped credential that lists permitted tools. The gateway validates every tool call against this credential before forwarding the request.

For Cohere Health, this means a policy digitization agent can call document parsing APIs and knowledge base lookups but cannot access billing systems or patient records outside its scope. The gateway logs every tool invocation with tenant ID, timestamp, and request payload for audit trails.

The gateway also handles rate limiting and quota enforcement per tenant. If Tenant A’s agent makes 10,000 API calls in a minute, it hits its limit without affecting Tenant B’s throughput. This prevents noisy neighbor problems in multi-tenant deployments.

State Isolation with AgentCore Memory

AgentCore Memory provides key-value storage scoped to each tenant. When an agent stores intermediate results or conversation history, the data is tagged with the tenant ID and encrypted at rest. Retrieval requests include the tenant credential, and the memory layer rejects queries that don’t match.

The memory component supports versioning. If a clinical policy agent updates its understanding of a guideline, the system retains previous versions with timestamps. This enables rollback and audit compliance. Cohere Health uses this to track how policy interpretations evolve over time.

Memory isolation extends to vector embeddings. If agents use retrieval-augmented generation, each tenant’s embeddings live in a separate namespace. Cross-tenant semantic search is impossible by design.

Agent Skills as a Transparency Layer

The Agent Skills open standard defines agents as declarative configurations. Each skill specifies:

Input schema
Output schema
Tool dependencies
Execution constraints

Cohere Health publishes clinical policy agents as versioned skills. A human reviewer can inspect the skill definition to understand what the agent does without reading code. The skill includes the model version, prompt template, and allowed tools.

This transparency matters for regulatory approval. When a healthcare auditor asks how a policy decision was made, Cohere can point to the exact skill version, the tools it called, and the reasoning trace. The skill definition serves as documentation.

Skills also enable composition. A high-level workflow agent can invoke multiple policy digitization skills in sequence, passing outputs as inputs. The orchestration layer tracks which skills ran and in what order.

Deployment and Scaling Primitives

AgentCore handles agent lifecycle through a control plane API. Deploying a new agent version involves:

Uploading the skill definition to the control plane
Specifying the tenant ID and resource limits
Triggering a deployment that provisions MicroVMs

The control plane schedules MicroVMs across availability zones for fault tolerance. If a VM fails, the control plane detects the health check failure and provisions a replacement. In-flight requests are retried automatically.

Scaling happens at the tenant level. If Tenant A’s workload spikes, the control plane provisions additional MicroVMs for that tenant without touching other tenants’ resources. Auto-scaling policies can trigger based on queue depth, CPU utilization, or custom metrics.

Security Boundaries in Practice

Boundary Type	Mechanism	Failure Mode
Memory isolation	Hypervisor-enforced address spaces	VM escape (mitigated by Firecracker)
Tool access	Gateway credential validation	Stolen credential (mitigated by short TTLs)
State isolation	Tenant-scoped encryption keys	Key compromise (mitigated by rotation)
Network isolation	Per-VM network namespaces	Misconfigured security group
Audit trail	Immutable logs per tenant	Log tampering (mitigated by write-once storage)

The weakest link is credential management. If an attacker steals a tenant’s gateway credential, they can invoke tools until the credential expires. AgentCore issues credentials with 15-minute TTLs and rotates them automatically. Cohere Health adds an additional layer by requiring mutual TLS for gateway connections.

Observable Orchestration

AgentCore emits structured logs for every agent invocation. Each log entry includes:

Tenant ID
Agent skill version
Tool calls with arguments
Execution duration
Error codes

Cohere Health pipes these logs to CloudWatch and builds dashboards showing agent success rates, latency percentiles, and tool usage patterns per tenant. When a policy agent fails, the logs reveal which tool call failed and why.

Distributed tracing works across the stack. A single policy digitization request generates trace spans for the orchestrator, each skill invocation, and every tool call. The trace ID propagates through headers, making it possible to reconstruct the full execution path.

Code Example: Skill Definition

apiVersion: agentcore.aws/v1
kind: AgentSkill
metadata:
  name: clinical-policy-digitizer
  version: 2.1.0
  tenant: cohere-health-prod
spec:
  model:
    provider: bedrock
    modelId: anthropic.claude-3-sonnet
  tools:
    - name: parse-pdf
      endpoint: https://gateway.agentcore.aws/tools/parse-pdf
      scopes: [document.read]
    - name: query-knowledge-base
      endpoint: https://gateway.agentcore.aws/tools/kb-query
      scopes: [kb.read]
  constraints:
    maxTokens: 4096
    timeout: 30s
    memoryMB: 512
  input:
    type: object
    properties:
      policyDocument:
        type: string
        format: uri
  output:
    type: object
    properties:
      digitalizedPolicy:
        type: object
      confidence:
        type: number

This skill definition tells AgentCore exactly what resources the agent needs and what it can access. The gateway enforces the tool scopes, and the runtime enforces the memory and timeout constraints.

Likely Failure Modes

MicroVM provisioning delays: If the pre-warmed pool is empty, cold starts can take 500ms. Cohere Health mitigates this by over-provisioning the pool during peak hours.

Gateway throttling: High tool call volume can hit gateway rate limits. The solution is to implement exponential backoff in the agent’s tool invocation logic.

Memory quota exhaustion: If an agent stores too much state, it hits the tenant’s memory quota. AgentCore rejects new writes but doesn’t evict existing data, so the agent must implement cleanup logic.

Skill version conflicts: Deploying a new skill version while old invocations are in-flight can cause schema mismatches. The control plane supports blue-green deployments to avoid this.

Technical Verdict

Use AgentCore’s MicroVM isolation when you need hard multi-tenancy guarantees and can tolerate the operational overhead of managing a control plane. The architecture fits regulated industries (healthcare, finance) where tenant data leakage is unacceptable.

Avoid it if your agents are single-tenant or if you can achieve sufficient isolation with container-level boundaries. The MicroVM overhead (memory, boot time, orchestration complexity) is wasted if you don’t need hypervisor-enforced isolation.

The Agent Skills standard is valuable even outside AgentCore. If you’re building agentic systems that require human oversight or regulatory approval, declarative skill definitions provide the transparency you need.

For Cohere Health, the trade-off was clear: the operational cost of running MicroVMs is lower than the regulatory risk of tenant data leakage. Your calculus will depend on your threat model and compliance requirements.

Source Links

How Cohere Health digitizes clinical policies using Amazon Bedrock AgentCore

Agentic AI, minus the noise.