Amazon Bedrock AgentCore Memory Adds Fine-Grained Access Control

FGAC lets developers front Memory resources with an AgentCore Gateway configured for OAuth (JWT) authentication and attach Cedar policies that restrict access by identity. This eliminates the need to hand-roll authorization logic and enforces isolation based on the authenticated caller — a critical requirement for multi-tenant agent deployments where one user's long-term memory must never leak to another.

Under the hood, the AgentCore Memory connector exposes 12 Memory operations as Cedar actions, so teams can write declarative policies (e.g., allow read/write only for a given tenant or role) rather than embedding checks throughout application code. AWS shipped this alongside flexible namespace variables that let memories be scoped by organization, tenant, team, or environment.

The update targets enterprises building persistent, personalized agents where memory governance is a blocker to production. It fits AWS's broader agentic push this week — Grok 4.6 on Bedrock, AgentCore payments reaching GA with x402 and Coinbase support, and a reported expanded NVIDIA partnership involving up to 2 million GPUs. Competitively, it answers Microsoft Foundry and Google Vertex AI Agent Builder on the security and multi-tenancy front, an increasingly decisive axis as agents move from demos to regulated deployments. Watch for adoption signals from financial-services and healthcare customers who cited memory isolation as a gating concern.