Five policy types carry the everyday work, one line of defence each: what is harmful, what is off limits, what is banned by name, what is private, and what the source does not support. A sixth, Automated Reasoning checks, tests an answer against a formal model of a written policy, and it rarely comes up at this level.
The material lists the features of responsible AI as “bias, fairness, inclusivity, robustness, safety, veracity”. A guardrail covers two of those directly. Content and word filters serve safety by catching toxicity before it reaches anyone. The contextual grounding check serves veracity by refusing an answer the source will not carry. It leaves the rest to other tools, which is the sorting a scenario usually wants. Grounding is the one candidates forget, so pair this card with the wider set of moves against a confident wrong answer. Configuring the policies for real goes well past what this level asks for.
Flash card
Amazon Bedrock Guardrails: a configurable safety layer applied to prompts and to responses independently of the model, so the same written policy holds when the model underneath it changes.
- Content filters catch harmful material in five categories, hate, insults, sexual content, violence and misconduct, and a sixth category catches prompt attacks on the way in. Each one is set to a strength of none, low, medium or high, and turning the strength up catches more while blocking more innocent text with it, so the level is a judgement about the audience rather than a default. This is the toxicity control, and the five harm categories are graded on the prompt and on the response separately.
- Denied topics are written in natural language: a short name, a sentence or two describing the subject, and a few example phrases. A retail assistant can be told it does not discuss legal advice without anyone listing the words that would signal it. That covers both safety, keeping the assistant off ground it has no business on, and controllability, keeping it inside the job it was deployed for.
- Word filters block an exact list of words and phrases you supply, and switch on a managed profanity list AWS maintains. Competitor names, a product that has been withdrawn, and language you would not want in a transcript are all the same kind of rule, matched literally rather than judged.
- Sensitive information filters handle personally identifiable information [PII]. Each type, an email address, a phone number, a credit card number, is set to block the request outright or to mask the value with a placeholder, and a regular expression covers formats particular to your organisation, like an internal account number. Masking lets the conversation continue with the private value removed, which serves privacy and security without ending the interaction.
- The contextual grounding check scores a response twice: grounding, meaning how far the answer is supported by the source material passed with the request, and relevance, meaning how far it answers what was actually asked. Set a threshold on each and anything scoring below it is blocked. This is the hallucination control, and it is where a guardrail speaks to veracity.
Pick it when
Pick it whenever a generative feature faces people outside the team. The policies are written once and attach to any Amazon Bedrock model, to a Knowledge Base and to an Agent, and they are versioned, so a change can be tested before it goes live. A guardrail can also be called on its own through the ApplyGuardrail API, which applies the same policies to text your own code produced or to a model running somewhere other than Bedrock. Reach for it whenever a requirement is stated as a rule the assistant must not break, because a system prompt is text the model can be talked out of and a guardrail is enforcement outside the model.
It's the wrong answer when
It is the wrong answer for measuring anything. A guardrail enforces at runtime, on one request at a time, so it never tells you whether a model treats demographic groups differently. Bias and fairness come from an offline evaluation job, from subgroup analysis and from human review of the outputs, and those are the tools to name when a scenario asks about measurement rather than enforcement. It is also the wrong answer for access control, which is AWS Identity and Access Management [IAM], and for keeping traffic inside the network, which is a virtual private cloud [VPC] endpoint.