Cloud shared responsibility boundaries

Bedrock's retrieval planner decides how many hops must carry the tenant filter

Agentic retrieval turns one question into an unknown number of lookups, and each is a place isolation can fail, which is why the interesting line in AWS's design is the one still leaving per-user isolation with your application.