AWS, Google, and Microsoft All Agree the Session Is the New Unit of Compute. They Can't Agree on How to Isolate It.

Three separate teams at three separate companies, working on three separate products, reached the same architectural conclusion independently: the AI agent session — not the container, not the function invocation, not the VM — is now the fundamental unit of compute that cloud infrastructure needs to manage. How each cloud isolates that session reveals fundamentally different assumptions about what agentic workloads actually require.

How It Works

The convergence point: An AI agent session is stateful across time, multi-step in its execution, and non-deterministic in how long it runs. Traditional compute primitives (Lambda invocations, container instances, pod lifecycles) were designed for request/response or batch models — they don’t naturally map to a session that might last 11 minutes or 19 days, spawn sub-agents, call external APIs, and accumulate context state throughout.

All three cloud providers have arrived at a session-as-primitive model to address this mismatch:

AWS — microVM per session. AWS Bedrock and the broader AWS agent infrastructure use Firecracker microVMs to isolate each agent session. A Firecracker microVM boots in under 125ms and provides hardware-level isolation between sessions — the same isolation model AWS Lambda runs on, adapted for session-scoped workloads. A new session = a new microVM. State is preserved within the microVM lifetime; cleanup is isolation-guaranteed on termination.

Google — dedicated sandbox per session. Google Cloud’s agentic runtime uses per-session dedicated sandboxes — the exact isolation mechanism is distinct from the microVM model, with Google emphasizing their approach’s suitability for AI workloads that require filesystem persistence and network isolation within the session boundary. Each session gets its own isolated execution context that does not share kernel state with other sessions.

Microsoft — per-session isolation rebuilt in April. Microsoft rebuilt Azure AI Foundry in April 2026 specifically to introduce per-session isolation. The pre-April architecture used a shared runtime model; the rebuild moved to per-session isolation as a first-class architectural principle. The April rebuild is a significant signal: Microsoft concluded that the shared runtime model was fundamentally incompatible with production agentic workloads and made a breaking architectural change to address it.

Anthropic — session + harness + sandbox. Anthropic’s approach (as seen in Claude Code) pairs the session with an explicit harness layer and a sandboxed execution environment. The harness mediates tool calls, manages state, and enforces permission boundaries; the sandbox provides filesystem and process isolation for code execution within the session.

What This Means for You

Platform engineers building agentic infrastructure — whether on a cloud provider or self-hosted — are facing a choice point that didn’t exist 18 months ago: pick a session isolation model before your workload demands force the decision.

The choice maps onto the workload characteristics you expect:

The isolation model you choose determines: cost per session (microVMs are cheaper at high volume; dedicated sandboxes carry more overhead), state management architecture (where does session state live after the microVM terminates?), and security surface (what does cross-session data leakage look like if isolation fails?).

The Microsoft April rebuild is the most instructive data point here: a cloud provider with millions of customers concluded that shared-runtime agentic workloads were not production-safe and rebuilt the entire layer. If you’re building on a shared execution model and calling it good enough for agentic workloads, that decision deserves re-examination.

Source: The New Stack

Content created with AI assistance and reviewed for accuracy.