Amazon Bedrock Guardrails

Amazon Bedrock Guardrails is a managed AWS service that checks a prompt or a model response against policies you configure and reports which policy intervened.

Last updated: 09 Oct, 2026 · OpenAI SDK 3.3

AI guardrails introduced the idea of a check on the way in and a check on the way out. The agent of Agentic RAG API with FastAPI and LangGraph has both as graph nodes, and both call this service. A guardrail is a set of classifiers with settings. It lowers the chance that a bad request or a bad answer gets through; it does not bring that chance to zero, and the tests in the video show a policy that misses and a good request that is refused.

The six policy types

• Denied topics. Subjects the application must not discuss, each described in a sentence with a few sample phrases.
• Content filters. Six categories (hate, insults, sexual, violence, misconduct, prompt attack), each with a strength from NONE to HIGH. A higher strength blocks more, including borderline text.
• Sensitive information filters. Personal data types such as e-mail, phone and card number, plus your own regular expressions. Each type is either blocked or anonymized, that is, replaced by a tag such as {PHONE}.
• Contextual grounding checks. Two scores for an answer: is it supported by the source text, and does it answer the question.
• Word filters. Exact words and phrases to block, and a managed profanity list.
• Automated Reasoning checks. Formal rules that a response is checked against.

The project uses the first four. It works with a guardrail in two steps: create it once with the control-plane API CreateGuardrail, then call ApplyGuardrail on every request. ApplyGuardrail checks text without calling any foundation model, so it works in front of any model, on Bedrock or elsewhere.

Creating the guardrail

The project's script scripts/create_bedrock_guardrail.py makes one create_guardrail call. Its outline:

import boto3

client = boto3.client("bedrock", region_name="us-east-1")
response = client.create_guardrail(
    name="arxiv-rag-guardrail",
    # the four policy arguments shown below go here
    blockedInputMessaging="I'm sorry, but I can only answer questions about computer science, AI, and "
                          "machine learning research papers. Please ask a question related to these topics.",
    blockedOutputsMessaging="I'm sorry, but I cannot provide this response as it doesn't meet our content "
                            "guidelines or is not sufficiently grounded in the research papers.",
)
print(response["guardrailId"], response["version"])

Shown as it ran in the video, not run here: it needs an AWS account with access to Amazon Bedrock and permission to create guardrails.

A new guardrail starts as a working draft, version DRAFT; numbered versions are created separately when a configuration is ready to be frozen. The two messages are what the service returns in place of a blocked question or answer.

The denied topic

topicPolicyConfig={
    "topicsConfig": [
        {
            "name": "off-topic-queries",
            "definition": (
                "Questions or requests that are not related to computer science, "
                "artificial intelligence, machine learning, deep learning, data science, "
                "robotics, or academic research papers in these fields."
            ),
            "examples": [
                "What is the weather today?",
                "How do I cook pasta?",
                "Tell me about politics",
                "Who won the football game?",
                "Help me write a poem about love",
            ],
            "type": "DENY",
        }
    ]
},

The content filters

contentPolicyConfig={
    "filtersConfig": [
        {"type": "HATE", "inputStrength": "HIGH", "outputStrength": "HIGH"},
        {"type": "INSULTS", "inputStrength": "MEDIUM", "outputStrength": "MEDIUM"},
        {"type": "SEXUAL", "inputStrength": "HIGH", "outputStrength": "HIGH"},
        {"type": "VIOLENCE", "inputStrength": "MEDIUM", "outputStrength": "MEDIUM"},
        {"type": "MISCONDUCT", "inputStrength": "HIGH", "outputStrength": "HIGH"},
        {"type": "PROMPT_ATTACK", "inputStrength": "HIGH", "outputStrength": "NONE"},
    ]
},

Strength is set separately for the question (inputStrength) and the answer (outputStrength). PROMPT_ATTACK, the filter for prompt injection and jailbreak attempts from Prompt injection and jailbreaks, applies to input only, so its output strength is NONE.

The sensitive information filters

sensitiveInformationPolicyConfig={
    "piiEntitiesConfig": [
        {"type": "EMAIL", "action": "ANONYMIZE"},
        {"type": "PHONE", "action": "ANONYMIZE"},
        {"type": "NAME", "action": "ANONYMIZE"},
        {"type": "ADDRESS", "action": "ANONYMIZE"},
        {"type": "CREDIT_DEBIT_CARD_NUMBER", "action": "BLOCK"},
        {"type": "AWS_ACCESS_KEY", "action": "BLOCK"},
        {"type": "AWS_SECRET_KEY", "action": "BLOCK"},
    ]
},

Four types are anonymized and the request goes on with the tag in place of the value. Three are blocked: a card number or an AWS key stops the request.

The contextual grounding checks

contextualGroundingPolicyConfig={
    "filtersConfig": [
        {"type": "GROUNDING", "threshold": 0.7},
        {"type": "RELEVANCE", "threshold": 0.7},
    ]
},

Checking a question with ApplyGuardrail

runtime = boto3.client("bedrock-runtime", region_name="us-east-1")
response = runtime.apply_guardrail(
    guardrailIdentifier="<guardrail-id>",
    guardrailVersion="DRAFT",
    source="INPUT",                          # "OUTPUT" when checking an answer
    content=[{"text": {"text": query}}],
)

Shown as it ran in the video, not run here: it needs an AWS account and the id of a guardrail created there.

The response has an action, which is NONE when nothing fired and GUARDRAIL_INTERVENED otherwise, and a list of assessments that names each policy item with its own action. The project turns that into two things: an allowed flag and a reason string. An intervention that only anonymized personal data still counts as allowed. The guardrail node then maps allowed to a score of 100 and blocked to 0.

The function below does the same reading. The four responses are written by hand in the shape the AWS documentation gives for ApplyGuardrail; no AWS call is made.

POLICIES = [("topicPolicy", "topics", "topic", "name"),
            ("contentPolicy", "filters", "content", "type"),
            ("sensitiveInformationPolicy", "piiEntities", "pii", "type")]

def read_guardrail(response):
    """Return (allowed, reason) the way the project's service reads an ApplyGuardrail response."""
    if response["action"] == "NONE":
        return True, "Content passed all guardrail checks"
    reasons, hard_block = [], False
    for assessment in response["assessments"]:
        for policy, items, label, field in POLICIES:
            for item in assessment.get(policy, {}).get(items, []):
                if item["action"] == "BLOCKED":
                    hard_block = True
                    reasons.append(f"{label}_blocked: {item[field]}")
                elif item["action"] == "ANONYMIZED":
                    reasons.append(f"pii_anonymized: {item[field]}")
    return not hard_block, "; ".join(reasons)

samples = {
    "in-domain question": {"action": "NONE", "assessments": [{}]},
    "off-topic and hateful": {"action": "GUARDRAIL_INTERVENED", "assessments": [{
        "topicPolicy": {"topics": [{"name": "off-topic-queries", "type": "DENY", "action": "BLOCKED"}]},
        "contentPolicy": {"filters": [{"type": "HATE", "confidence": "HIGH", "action": "BLOCKED"}]}}]},
    "phone number only": {"action": "GUARDRAIL_INTERVENED", "assessments": [{
        "sensitiveInformationPolicy": {"piiEntities": [{"type": "PHONE", "action": "ANONYMIZED"}]}}]},
    "card number": {"action": "GUARDRAIL_INTERVENED", "assessments": [{
        "sensitiveInformationPolicy": {"piiEntities": [
            {"type": "CREDIT_DEBIT_CARD_NUMBER", "action": "BLOCKED"}]}}]},
}

for label, response in samples.items():
    allowed, reason = read_guardrail(response)
    score = 100 if allowed else 0                       # the guardrail node's mapping
    routes = ["continue" if score >= threshold else "out_of_scope" for threshold in (40, 60)]
    print(f"{label:22} score {score:3}  at 40: {routes[0]:12}  at 60: {routes[1]:12}  {reason}")

in-domain question     score 100  at 40: continue      at 60: continue      Content passed all guardrail checks
off-topic and hateful  score   0  at 40: out_of_scope  at 60: out_of_scope  topic_blocked: off-topic-queries; content_blocked: HATE
phone number only      score 100  at 40: continue      at 60: continue      pii_anonymized: PHONE
card number            score   0  at 40: out_of_scope  at 60: out_of_scope  pii_blocked: CREDIT_DEBIT_CARD_NUMBER

What the four sample responses turned into

• An untouched question has action NONE and comes out as score 100 with the reason "Content passed all guardrail checks", the string on the guardrail span in the video's trace.
• Two blocked items give two reasons joined by a semicolon: topic_blocked: off-topic-queries; content_blocked: HATE. The reply to the third test request in the video carries this same string.
• The phone-number response intervened and is still allowed. Its only item is ANONYMIZED, so the score is 100 and the reason reads pii_anonymized: PHONE.
• The card-number response is blocked: score 0, pii_blocked: CREDIT_DEBIT_CARD_NUMBER.
• The route at 40 and at 60 is the same on every line. A score that is only ever 0 or 100 leaves a threshold nothing to decide.

Testing an off-topic question

This part of the video starts at 6:22:28. The assistant is built for research papers in computer science and machine learning. The video asks it "What is the best pasta recipe?" through curl -X POST http://localhost:8000/api/v1/ask-agentic and reads the reply.

The reply is the refusal text of the out_of_scope node, and the JSON around it tells what happened: "guardrail_filter": "topic_blocked: off-topic-queries", "retrieval_attempts": 0, "sources": []. The request returned in 2.115 s. Sent straight to a model, the same question would get a recipe; here the search and the model were never called.

Two other fields of that reply are fixed values, not a record of work done: "chunks_used": 3 repeats the request's top_k, and the step "Generated answer from context" is appended to every reply. Nothing was retrieved and nothing was generated for a blocked question.

Testing the content and PII filters

This part of the video starts at 6:26:39. The next requests are written to be harmful. Each one is meant to trip one content filter, and the guardrail_filter field of the reply names the filter that fired. The video then sends two requests that contain personal data.

What the seven results show

• Every request was stopped at the input check, with retrieval_attempts 0, in 1.0 to 2.4 seconds measured at the shell.
• Request 3 has two reasons, the denied topic and the hate filter. Requests 4 and 5 are off topic as well, and carry only the content filter's name: the topic policy did not fire on them. A topic classifier gives a judgement, not a rule, and it can miss.
• Request 6 asks for papers on neural networks, which is in scope, and it was blocked by the topic policy: the reply reads topic_blocked: off-topic-queries and carries the refusal text. No pii_anonymized appears in the filter field, so no redaction is shown. With the phone type set to ANONYMIZE, a request that gets past the topic policy goes on with the number replaced, as the phone-number line of the sample-response example printed. This is a false positive: a good request refused.
• Request 7 was blocked by the card-number rule, as configured. It also asks an in-scope question; the BLOCK action stops the whole request.
• Seven requests are a demonstration, not a measurement. Measuring a guardrail shows how to count misses and false positives on a labelled set.

Writing a denied topic

The AWS guidance for denied topics is to describe the topic itself in a clear sentence, with a few sample phrases, and not to define a topic by negation or exception. A definition of up to 200 characters and up to five sample phrases are allowed. The project's definition begins "Questions or requests that are not related to computer science, ...", which is a definition by negation: it asks the classifier to recognise everything outside a set. Request 6 shows the cost. A request that mentions a phone call and neural networks looked, to the classifier, enough like "not about research" to be denied.

• Deny what you can name. One topic per subject you have seen in real traffic (cooking, politics, sport), each with its own sample phrases.
• Keep the scope decision somewhere it can be tuned. A separate scope check with a score and a threshold, such as the prompt further down, can be adjusted without redefining a topic.
• Test in-scope requests too. A guardrail that blocks everything passes every attack test.

Grounding and relevance checks on the answer

The contextual grounding policy runs on the answer, not on the question. It gives the answer two confidence scores:

• Grounding: is the answer supported by the source text it was given? Any information in the answer that is not in the source counts as ungrounded.
• Relevance: does the answer respond to the user's question?

With both thresholds at 0.7, an answer whose grounding score or relevance score is below 0.7 is blocked. Thresholds can be set from 0 up to 0.99. Both scores judge the answer. Whether the retrieved chunks suit the question is a different check, and in this project it is the grade_documents node that makes it.

To score an answer, the service needs three pieces of text, each marked with a qualifier: the source, the question and the answer to guard. The project builds them like this in its output check:

content = [
    {"text": {"text": doc, "qualifiers": ["grounding_source"]}}
    for doc in source_docs
    if doc.strip()
]
if query:
    content.append({"text": {"text": query, "qualifiers": ["query"]}})
content.append({"text": {"text": answer, "qualifiers": ["guard_content"]}})

Shown as it ran in the video, not run here: it needs an AWS account and a guardrail with the grounding policy. The video's tests all stop at the input check, so no blocked answer appears in it. Faithfulness measures the same idea, an answer supported by its context, with an LLM judge.

The project's earlier scope prompt on Groq

Before the guardrail node called Bedrock, it asked a model to score each question from 0 to 100, and the prompt is still in the project's prompts.py. Bedrock needs an AWS account; a prompt runs on any chat model. The example sends that prompt, unchanged, to openai/gpt-oss-120b on Groq with four of the video's test questions, asks for JSON, and applies the two thresholds the project has used, 40 and 60.

import json
import os

from openai import OpenAI

client = OpenAI(base_url="https://api.groq.com/openai/v1", api_key=os.environ["GROQ_API_KEY"])
MODEL = "openai/gpt-oss-120b"

# the project's GUARDRAIL_PROMPT, word for word
GUARDRAIL_PROMPT = """You are a guardrail evaluator assessing whether a user query is within the scope of academic research papers from arXiv in Computer Science, AI, and Machine Learning.

User Query: {question}

Evaluate whether this query is:
- About CS/AI/ML research topics (neural networks, algorithms, models, architectures, techniques, etc.)
- Requires academic paper knowledge to answer
- Within the domain of Computer Science research

Assign a relevance score (0-100):
- 80-100: Clearly about CS/AI/ML research (e.g., "What are transformer architectures?", "How does BERT work?")
- 60-79: Potentially research-related but unclear (e.g., "Tell me about attention mechanisms")
- 40-59: Borderline or ambiguous (e.g., "What is machine learning?")
- 0-39: NOT about research papers (e.g., "What is a dog?", "Hello", "What is 2+2?")

Provide:
1. A score between 0 and 100
2. A brief reason explaining why you gave this score

Respond in JSON format with 'score' (integer 0-100) and 'reason' (string) fields."""

queries = ["What is the best pasta recipe?",
           "what is Vector Policy?",
           "Call me at +1-555-867-5309, I need help finding papers on neural networks",
           "Who won the US presidential elections in 2025?"]

for q in queries:
    reply = client.chat.completions.create(
        model=MODEL, temperature=0, max_tokens=400, response_format={"type": "json_object"},
        messages=[{"role": "user", "content": GUARDRAIL_PROMPT.format(question=q)}])
    result = json.loads(reply.choices[0].message.content)
    routes = ["continue" if result["score"] >= threshold else "out_of_scope" for threshold in (40, 60)]
    print(f"{q}\n   score {result['score']}  at 40: {routes[0]}  at 60: {routes[1]}\n   {result['reason']}")

What is the best pasta recipe?
   score 0  at 40: out_of_scope  at 60: out_of_scope
   The query asks for a pasta recipe, which is unrelated to computer science, AI, or machine learning research topics and does not require academic paper knowledge.
what is Vector Policy?
   score 55  at 40: continue  at 60: out_of_scope
   The term 'Vector Policy' is not a well‑known standard concept in CS/AI/ML literature, making the query ambiguous. It could refer to a niche research topic (e.g., in reinforcement learning or control theory), so it is somewhat related to the domain but not clearly a mainstream research question.
Call me at +1-555-867-5309, I need help finding papers on neural networks
   score 88  at 40: continue  at 60: continue
   The user explicitly asks for help finding papers on neural networks, which is a core AI/ML research topic, requiring academic paper knowledge. The request is clearly within the scope of Computer Science research.
Who won the US presidential elections in 2025?
   score 5  at 40: out_of_scope  at 60: out_of_scope
   The query asks about a political election outcome, which is unrelated to computer science, AI, or machine learning research topics and does not require academic paper knowledge.

What the model scored

• The recipe and the election question scored 0 and 5 and are out of scope at both thresholds, the same decision the Bedrock topic policy made.
• The request with the phone number scored 88 and continues. The model read past the number to "papers on neural networks". Bedrock's topic policy refused this request in the video. The prompt does nothing about the number itself, though: it would travel on to the search, the model and the trace unmasked.
• "what is Vector Policy?" scored 55: it continues at threshold 40 and is refused at 60. The model's reason is that the term is not a well-known concept. This is the question the video's agent answered from the paper on Vector Policy Optimization in its index. A scope prompt judges from what the model already knows, so a question about a new paper can look out of scope, and here the threshold alone decides whether the user gets an answer.
• With this guard the threshold matters, unlike the 0-or-100 score of the Bedrock mapping. These are the scores of one run at temperature 0; another model can draw the lines elsewhere.

Bedrock Guardrails vs an LLM scope prompt

Where you use Amazon Bedrock Guardrails

• In front of any model. ApplyGuardrail takes text, so the model behind it can be on Bedrock, on Groq or on your own server.
• Where personal data arrives in free text. Anonymizing a phone number or an address before the text reaches a model, a log or a trace.
• On RAG answers. The grounding check is a last gate against an answer that says more than its sources.

Related

• Previous: Tracing agents with Langfuse
• Next: Hybrid search with BM25 and vector search
• See also: AI guardrails, Input and output rails, Measuring a guardrail
• Reference: Amazon Bedrock Guardrails, Denied topics, Contextual grounding check