Continue the series
AgentCore Gateway, 1 of 5. Next installment: The Tenant Boundary: Why Cedar and Rate Limits Are Not Data Isolation, publishing 29 October. You can also view the complete series.
A refund tool can pass an authorization check and still refund the wrong tenant’s order. It can satisfy an amount threshold and still execute twice. It can appear in an agent’s tool list while a particular invocation is forbidden.
These are different questions, and a production architecture must keep them different.
Analysis: Amazon Bedrock AgentCore Gateway belongs in the managed tool control plane: the shared machinery for exposing tools, authenticating callers, applying access policy, controlling consumption, and observing requests. It should centralize those controls. Your application and business backends must still enforce tenant ownership, approval authority, and transaction correctness.
This is the first article in a five-part series for AWS-hosted, multi-tenant agent platforms. The running example is an order operations platform that starts with order lookup and later permits refunds. The useful question is not whether Gateway provides governance features. It is which guarantees remain true after Gateway allows a request.
Table of contents
Open Table of contents
Define the managed boundary
Verified AWS behavior: Gateway supports Lambda, API Gateway, OpenAPI, Smithy, MCP-server, HTTP passthrough, and Runtime integration patterns. Those names do not describe interchangeable execution paths. MCP aggregation and HTTP target modes have different semantics, and outbound credentials depend on the target configuration. Source: Core concepts for Amazon Bedrock AgentCore Gateway.
That distinction matters before security policy enters the discussion. An existing REST service, a Lambda function, and an external MCP server have different identities, connection paths, and operational dependencies. Listing them behind one endpoint does not normalize every trust boundary.
Analysis: Evaluate each target as a separate integration contract. Record who authenticates the caller, what identity the backend receives, which principal can invoke the target directly, and which network path carries the request. Include the owner responsible for proving each answer.
Figure 1. Shared access controls reduce repeated platform work; application guarantees still need explicit owners.
Verified AWS behavior: Private ingress and private egress are separate configurations. Clients in a VPC can use an AgentCore VPC endpoint for private access to Gateway APIs. Gateway-to-target private connectivity is target-specific, with VPC Lattice/privateEndpoint options documented for supported targets. Source: Configure Amazon Bedrock AgentCore Runtime and tools for VPC; Configure Amazon Bedrock AgentCore Gateway VPC Egress for Gateway Targets.
Verify before deployment: Check the exact target, outbound authentication method, account arrangement, and private networking combination you intend to deploy. A successful private MCP-server integration does not prove that an API Gateway target supports the same arrangement.
Separate visibility, permission, and correctness
Verified AWS behavior: Policy in AgentCore uses default-deny and forbid-wins semantics: an applicable permit is necessary, and a matching forbid overrides it. Source: Core concepts.
Verified AWS behavior: Discovery and invocation answer different questions. During tools/list, policy determines whether a tool could be callable under some circumstances. It does not have the actual invocation arguments. A later tools/call is evaluated separately with its input parameters. Tool visibility therefore does not grant permission for every call. Source: Use an AgentCore Gateway with Policy in AgentCore.
Consider request_refund. An operator might be allowed to discover it because some refunds are within their authority. A request above their limit can still be denied when its amount is known. Neither result establishes whether the referenced order belongs to the operator’s tenant or has already been refunded.
Analysis: Distinguish three decisions in design reviews:
| Decision | Question | Required evidence |
|---|---|---|
| Discovery | Could this principal use the tool? | Expected tool-list results for each role |
| Invocation | Is this specific call permitted? | Argument-aware allow and deny tests |
| Business execution | Is this state transition valid now? | Tenant, approval, concurrency, and transaction tests |
Semantic search belongs to tool selection. Even a highly relevant result needs invocation authorization and backend validation. Search quality should be evaluated separately from permission correctness.
There is another scope boundary: AWS documents Gateway policy evaluation for MCP tools, while MCP prompts and resources are allowed regardless of policy evaluation mode. Source: Use an AgentCore Gateway with Policy in AgentCore.
Analysis: Inventory every exposed protocol surface. Do not apply a tool-policy assurance statement to prompts, resources, or another target mode without verifying its actual enforcement behavior.
Keep business invariants with the business system
The refund backend is where an order becomes refunded. It must establish the conditions that make that transition legitimate.
Analysis: Tenant identity must originate in validated JWT claims or an IAM identity mapped through trusted membership data. A tenant identifier supplied in model-controlled arguments cannot establish authority. If the tool needs a tenant selector, compare it against authenticated membership rather than accepting it as identity.
This also requires an explicit propagation design. The backend might see a Gateway service identity rather than an end-user token. Document how trusted caller context reaches the backend for the chosen target. An arbitrary header becomes trustworthy only when its origin is authenticated and competing writers cannot spoof it.
At the data layer, load the order inside the authenticated tenant scope. Apply the same scope to writes, caches, object retrieval, and asynchronous job results. Reject a globally valid order identifier that belongs to another tenant. Prevent direct backend access that bypasses the trusted identity binding.
Figure 2. Gateway permission is an input to execution, not proof that a refund is valid or committed.
Analysis: Consequential writes also need approval semantics. A human approval should bind to the exact tenant, order, amount, currency, and intended operation, with expiry and replay rules. The backend should reject an approval after a material parameter change. A model-generated approved: true field is merely untrusted input.
Keep requester and approver authority separate where the business risk requires it. Recheck relevant order state at execution time. Approval of an earlier state should not authorize a later, materially different transaction.
Retries introduce another independent invariant. Persist a tenant-scoped idempotency key with a canonical request digest and result. Reject reuse with different parameters. Coordinate duplicate suppression with the business commit so a crash between “refund issued” and “result recorded” cannot silently create a second refund. For external effects, design reconciliation or a durable workflow around the external system’s guarantees.
Finally, assume retrieved documents and tool responses can contain hostile instructions. Narrow tool authority, validate inputs, constrain outputs, and require independent approval for high-impact effects. Gateway controls can constrain access; application design must still limit what happens when the agent chooses a harmful but syntactically valid action.
Treat consumption controls as consumption controls
Verified AWS behavior: Gateway rate limits can group traffic by configured dimensions. AWS documents fail-open behavior when the rate-limit service is unavailable or a dimension cannot be resolved. Source: Add rate limits to a gateway.
Analysis: A per-tenant rate limit can manage consumption without proving that any request belongs to that tenant. A zero-rate entry should not be your sole incident containment mechanism. Nor should an expected rate ceiling justify removing backend concurrency or spending protections.
For a compromised refund tool, prepare a targeted Cedar forbid for the affected tool or principal and an independent backend stop mechanism. Exercise both. Measure when new business effects actually cease, including queued work and already-running requests.
Verified AWS behavior: An engine attached in LOG_ONLY records policy decisions without enforcing them. ENFORCE applies those decisions. Permission to update the Gateway can change its policy configuration, including disabling enforcement. Source: Policy enforcement modes.
Analysis: An emergency forbid is useful only on an enforcing path. Protect mode-change authority and test containment against the deployed configuration. Observe candidate policy behavior before promotion, but keep early trials isolated or independently constrained while policy is not enforcing.
Decide whether Gateway earns its place
Analysis: Gateway is a strong candidate when several agents need a shared tool surface, centrally operated access controls, and consistent integration ownership. Its value increases when teams otherwise duplicate authentication, tool discovery, credential handling, and policy deployment.
It also introduces a managed dependency and configuration surface. You still operate backend contracts, identity propagation, policy changes, and incident response. For a narrow workload, compare that work against the concrete integration burden it removes.
Figure 3. Adoption proceeds through evidence gates; an unproven tool stays out of scope.
Make the decision against a real tool inventory. For each proposed tool, record its owner, target type, read/write risk, tenant context, data sensitivity, approval requirement, retry behavior, and containment method. This registry is a recommended operating artifact, not a claim that Gateway supplies the complete workflow.
A missing private connectivity or identity propagation capability can block one target without invalidating the entire platform. Start with the supported subset. Do not compensate for a missing trusted identity path by allowing the model to choose the tenant.
Require evidence before expanding authority
Analysis: Start with one tenant-scoped read and one consequential write in a controlled environment. Use these acceptance checkpoints:
- Identity: Expired credentials, invalid issuers, and missing tenant membership are rejected on the intended path.
- Isolation: A valid tenant A principal cannot read or mutate tenant B’s objects, including through direct backend access.
- Policy: Discovery behaves as expected, while forbidden invocation arguments are denied before backend effects.
- Approval: Changed intent, expired approval, and unauthorized approvers cannot authorize execution.
- Correctness: Concurrent retries and failure recovery produce the intended number of business effects.
- Containment: Targeted policy and backend stops prevent new effects, with propagation and in-flight behavior measured.
Capture evidence across the whole request. AWS exposes policy decision and determining-policy attributes through Gateway observability after tracing is enabled. Source: AgentCore generated policy observability data.
Analysis: Correlate those decisions with trusted tenant identity, tool/schema version, approval reference, and backend outcome. Store required audit evidence with restricted modification and an explicit retention policy. A trace showing “allowed” cannot establish that the business transaction committed correctly. Compare the approved registry with deployed Gateway targets and schemas to detect drift.
What this means in practice
Analysis: Adopt Gateway to centralize tool access controls, and fund backend guarantees as first-class work. Assign named owners for policy, tenant isolation, approval, transaction correctness, and evidence retention before exposing consequential tools.
Your next action is concrete: select one lookup tool and one write tool, fill in their ownership contracts, and run the six acceptance checks above. Expand only when the results are reviewable and containment works.