Good news, I've done the fix. Each listed principal now gets its own plane at deploy time. Now we have dedicated AgentCore runtime locked to its owner via resource policy, dedicated execution role confined to its storage trees via bucket policy