A single VRF in the common tenant removes the route duplication created by leaking prefixes among many tenant VRFs. In ACI, a VRF is a Layer 3 forwarding and policy domain, and objects placed in the common tenant can be consumed by user tenants. By attaching the relevant bridge domains and tenant application constructs to one shared common-tenant VRF, the fabric programs each reachable prefix in one routing context instead of replicating provider and consumer routes across numerous VRFs. This directly addresses the stated prefix-capacity pressure and eliminates the inter-VRF route-leaking machinery used only to provide communication between otherwise separate routing tables. Tenant-level security can still be enforced through EPGs, endpoint security groups, contracts, and filters even when the forwarding context is shared. The management tenant is reserved for ACI management connectivity and is not the correct location for production application routing. Options B and C preserve multiple VRFs and route leaking, so they retain the scaling problem rather than solve it. The single-common-VRF design is valid only when the tenants use nonoverlapping addressing and do not require hard routing-table isolation; overlapping prefixes or regulatory isolation would require separate VRFs and a different scale strategy. Under the question’s explicit goal of simplifying the architecture and reducing programmed prefixes, however, consolidating into one common-tenant VRF is the only option that removes the underlying source of route replication. Cisco ACI common-tenant sharing design

================