Each tenant gets a dedicated Firecracker micro-VM running their AI agent. Tenant isolation is a hard security boundary, not a shared runtime with guardrails bolted on.

A single CloudFormation template declares the full stack: VPC with EFS, Bedrock VPC endpoints, NAT egress, the MicroVM image (built server-side, no local Docker), a DynamoDB tenant registry, an orchestrator Lambda behind API Gateway, and an EventBridge sweeper. You upload two zip artifacts and run one deploy.

When a message arrives, the orchestrator checks the tenant registry. If the tenant's VM is suspended it resumes from snapshot in seconds with memory intact. If it's cold, a fresh VM launches, mounts the tenant's EFS subdirectory, and picks up where it left off. Warm turns complete in about two seconds.

The agent calls Bedrock through a VPC endpoint using temporary credentials from IMDSv2. Available models are discovered live at cold start so new models work without redeploying. All tenant state (config and conversation memory) lives on EFS and survives suspend, resume, and the 8-hour VM lifetime limit.

An EventBridge sweeper runs every 10 minutes, terminating idle VMs and reconciling the registry. Tenants flow from hot (running) to warm (suspended, barely billed) to cold (terminated, state parked on EFS at near-zero cost). You pay for conversations, not for waiting.