Guardrails and content safety

Amazon Bedrock Guardrails checks what goes into a model and what comes out, against policies you set. Content filters catch harmful categories (hate, insults, sexual content, violence, misconduct) at a strength you choose, and a prompt attack filter catches jailbreaks and prompt injection in the input. Denied topics block subjects you describe in plain words ("investment advice", say). Word filters block exact words and phrases, including a managed profanity list. Sensitive information filters find PII types (emails, phone numbers, card numbers and more) or your own regex patterns, and either block the message or mask the match.

Contextual grounding checks are for RAG and summaries: the guardrail scores whether the answer is supported by the source text (grounding) and whether it answers the question (relevance), and blocks it below your thresholds. That catches many hallucinations before a user sees them. Automated Reasoning checks go further for rule-heavy domains, testing answers against a formal policy you build from your documents; check its current availability.

You attach a guardrail to a model call by its id and version, and it works with agents and knowledge bases too. The ApplyGuardrail API runs a guardrail on any text without calling a Bedrock model, so you can use the same policies on a self-hosted model, a third-party API, or text from anywhere. When a guardrail steps in, the reply is the blocked message you configured and the stop reason says so.

Admins can require guardrails. An IAM policy condition on the guardrail identifier (bedrock:GuardrailIdentifier) can deny model calls that don't use the approved guardrail, so no team can skip it.

No single layer catches everything, so build defense in depth: validate and sanitize input in your API (length, allowed characters, Amazon Comprehend for PII or toxicity), keep instructions and user data apart in the prompt, run a guardrail on input and output, validate output in code (does it parse against the JSON schema, are the numbers in range), and filter API responses before they reach the client. For questions about data, letting the model write SQL that runs against the real database (text-to-SQL), rather than letting it state numbers from memory, gives deterministic answers.

Test it. Keep a set of known attacks and harmful prompts, run them automatically against every change (adversarial or red-team testing), and track how many get through.