Architecting Multi-Account AI Agents

Enterprise organizations frequently face challenges when deploying artificial intelligence systems that need to reason over data spread across multiple AWS environments. Maintaining distinct accounts for each business team provides clear data ownership, scope isolation, and independent deployment lifecycles. However, connecting an AI agent to distributed sources traditionally required replicating data or untangling complex cross-account setups involving AWS Identity and Access Management (IAM).

To solve these distributed data challenges without moving underlying datasets, developers can build multi-account architectures using the Model Context Protocol (MCP). By keeping data inside each line-of-business account, only the specific information requested during a query flows out, ensuring datasets never leave their owning storage location.

Centralized Platform and Gateway Integration

The core integration relies on a central platform account hosting the agent tier alongside large language model inference. The platform team manages available foundation models and applies content safety measures through Amazon Bedrock Guardrails. As demands grow, organizations can scale inference across dedicated accounts by implementing an Inference Gateway that routes traffic across model providers and enforces per-team rate limits.

Acting as the single integration endpoint, Amazon Bedrock AgentCore Gateway registers each line-of-business account's MCP server as a target. This central gateway provides unified tool discovery using semantic search, centralized authentication, fine-grained authorization, and system observability.

Line-of-Business MCP Servers

Rather than exposing raw cloud storage buckets, databases, or search indexes directly, each line-of-business team packages its data and operational tools as an MCP server. For instance, retail banking teams might expose functions for retrieving balances and profiles, while lending teams offer credit score checks and policy searches.

These distributed MCP servers run on AgentCore Runtime within each line-of-business account. This framework-agnostic environment offers session isolation in dedicated microVMs, consumption-based pricing, built-in authentication, and complete ownership of the underlying tool logic for individual teams.

Security, Identity, and Governance

Securing multi-account agent interactions requires robust authentication mechanisms across different service layers. When an agent invokes a tool, the integration layer retrieves OAuth 2.0 machine-to-machine credentials from AgentCore Identity. These credentials are attached to outbound requests and routed to the correct line-of-business MCP server, which authenticates the incoming tokens against Okta.

Furthermore, platform administrators can enforce strict content governance across the entire setup. By leveraging capabilities within Amazon Bedrock AgentCore, organizations gain deep visibility, policy enforcement, and reliable control structures suited for production-ready enterprise environments.

Sources

• AWS Machine Learning BlogBuild a multi-account AI agent with AgentCore Gateway and MCP