AWS moves AgentCore Memory tenant isolation into OAuth and Cedar policy

AWS shipped two complementary Amazon Bedrock AgentCore Memory controls on August 28, 2026. Fine-grained access control lets a Memory resource sit behind AgentCore Gateway with OAuth/JWT authentication and Cedar policies that authorize Memory operations based on the authenticated caller. Policies can enforce per-user or per-tenant actor access, restrict records to namespaces derived from token claims, and allow or deny individual Memory actions. Separately, flexible namespace variables let developers define up to five application-specific keys on a Memory resource — such as organization, tenant, team or environment — and substitute runtime values into long-term-memory namespace templates. AWS says the namespace feature is available in every region where AgentCore Memory is generally available with no additional charge.

Persistent agent memory is a data-isolation problem as much as a retrieval feature. Without a trustworthy boundary, one user or tenant can potentially retrieve another tenant’s remembered context through an application bug or overly broad server credential. AgentCore’s new controls let builders bind memory access to the caller’s cryptographically verified OAuth identity and express the boundary in infrastructure policy, rather than trusting every application path to manually filter actor IDs. Flexible namespace variables then make that policy usable for real multi-tenant hierarchies instead of forcing everything into built-in actor/session dimensions.

AgentCore Gateway can authenticate callers with OAuth/JWT and expose the identity to Cedar policy. AWS says the Memory connector maps 12 Memory operations to Cedar actions and makes request attributes available for policy conditions. A policy can therefore require that an authenticated user only reaches their own actor data or only a namespace derived from claims in their token.

AgentCore Memory already supported IAM policies for actions, resources, actors, sessions and namespaces. AWS’s documentation notes that IAM evaluates an AWS principal, not the end user represented by an OAuth token. The new gateway path is intended for applications where users authenticate through an OpenID Connect provider and memory authorization needs to follow that end-user identity.

Flexible namespace variables let an application define as many as five keys on a Memory resource and reuse them across strategies. A developer can model dimensions such as organization, tenant, team or environment, supply their values at event-ingestion time and have AgentCore substitute them into the namespace used for extracted long-term memories.

The useful pattern is to derive namespace values from trusted application identity and then enforce access to those namespaces in policy. That gives retrieval and consolidation a stable partition while making unauthorized cross-tenant access fail at the gateway rather than only in application code. It does not remove the need to design actor, session and namespace semantics carefully.

These controls apply to AgentCore Memory access. Builders still need separate authorization for tools, databases, files, external APIs and any application paths that bypass the Memory gateway. JWT claims, Cedar policies and namespace templates also need testing because a permissive policy or incorrectly mapped claim can recreate the boundary problem at a different layer.