7.1 Guardrails Architecture, Denied Topics & Content Filters

7.1 Guardrails Architecture, Denied Topics & Content Filters

This independent study guide by OpenExamPrep helps candidates prepare for the AWS Certified Generative AI Developer - Professional (AIP-C01) examination. Foundation models (FMs) hosted on Amazon Bedrock undergo baseline safety alignment (such as Reinforcement Learning from Human Feedback, or RLHF) conducted by model providers. However, provider-level alignment is generalized and cannot accommodate organization-specific compliance rules, brand safety policies, or domain-specific boundaries. Under the AWS Shared Responsibility Model for Generative AI, developers and enterprise architects are responsible for defining, enforcing, and auditing application-level safety boundaries.

Guardrails for Amazon Bedrock provides a fully managed, model-agnostic governance capability that evaluates both user inputs and model outputs against customized safety policies. Operating outside the model's internal weights, Guardrails provides consistent, deterministic policy enforcement across all Amazon Bedrock foundation models, custom imported models, Bedrock Agents, Bedrock Knowledge Bases, and even external models invoked through standalone evaluation APIs.

---

Multi-Layered Guardrails Architecture

Amazon Bedrock Guardrails acts as an inline security inspection layer positioned between client applications and the inference runtime. Rather than embedding complex safety rules into system prompts—which consumes valuable context window tokens and remains vulnerable to prompt injections—Guardrails decouples safety policies into independent, version-controlled AWS resources.

[User Input Prompt]
         │
         ▼
┌────────────────────────────────────────────────────────┐
│ Amazon Bedrock Guardrail (Input Evaluation)            │
│  ├── 1. Prompt Attack / Jailbreak Filter (Input Only)   │
│  ├── 2. Denied Topics Policy                           │
│  ├── 3. Content Filters (Hate, Insults, Violence...)   │
│  ├── 4. Sensitive Information Filters (PII / Regex)    │
│  └── 5. Word Filters (Profanity & Custom Word Lists)   │
└──────────────────────────┬─────────────────────────────┘
                           │ (Passed / Redacted)
                           ▼
             [Foundation Model / Agent / RAG]
                           │ (Model Output Text)
                           ▼
┌────────────────────────────────────────────────────────┐
│ Amazon Bedrock Guardrail (Output Evaluation)           │
│  ├── 1. Denied Topics Policy                           │
│  ├── 2. Content Filters (Hate, Insults, Violence...)   │
│  ├── 3. Sensitive Information Filters (PII / Regex)    │
│  ├── 4. Word Filters (Profanity & Custom Word Lists)   │
│  └── 5. Contextual Grounding Policy (RAG Factuality)   │
└──────────────────────────┬─────────────────────────────┘
                           │ (Passed / Redacted / Blocked)
                           ▼
                  [Final Application Output]

Core Touchpoints & Integrations

1. Native Foundation Model Invocation: Integrated directly within Converse, ConverseStream, InvokeModel, and InvokeModelWithResponseStream APIs by supplying a guardrailConfig payload.
2. Amazon Bedrock Agents: Bound directly to an agent configuration. The Guardrail inspects user input before the agent orchestrator invokes ReAct reasoning loops, and inspects final agent responses before returning them to the user.
3. Amazon Bedrock Knowledge Bases: Applied during RetrieveAndGenerate calls to sanitize retrieval queries and validate generated RAG responses against safety policies.
4. Standalone Evaluation (ApplyGuardrail API): Allows developers to evaluate arbitrary text payloads against guardrail policies independently of model inference. This enables sanitizing legacy databases, verifying outputs from external third-party models, or inspecting user inputs in custom middleware.

---

Denied Topics Policy

The Denied Topics Policy enables organizations to define strict subject-matter boundaries. If a user attempts to steer a conversation into an unauthorized domain—or if a model begins generating content related to a prohibited subject—the Guardrail intercepts the transaction and returns a predefined response.

How Denied Topics Work

Unlike naive keyword-matching or regex engines, Bedrock Guardrails uses a managed natural language semantic classification model to evaluate whether text falls within a denied topic. Each denied topic requires:

• Topic Name: A unique administrative identifier (e.g., InvestmentAdvice, LegalCounsel, MedicalDiagnosis).
• Topic Definition: A detailed natural language description of what constitutes the prohibited topic. The definition must clearly outline the scope and boundaries of the restricted subject.
• Sample Phrases: A curated list of representative user phrases (typically 3 to 10 sample inputs) that illustrate how users might attempt to request information on the denied topic, including colloquialisms, slang, and edge cases.

Input vs. Output Denied Topic Enforcement

• Input Evaluation: If the user's prompt matches a denied topic definition, Bedrock halts execution immediately. When an attached guardrail intervenes on the input, Bedrock returns the configured blocked response and discards foundation-model inference. Validate the exact integration path and current charging behavior rather than generalizing this to every separate guardrail check.
• Output Evaluation: If the foundation model generates completion text that wanders into a denied topic (for example, in response to an adversarial prompt that bypassed input checks), the output filter catches the violation, discards the generated text, and returns the configured message.

Custom Blocked Messaging (blockedMessaging)

When a Denied Topic is triggered, Guardrails suppresses the standard response and emits a user-configured message. Developers can specify distinct messages for input and output violations:

• Input Block Message: E.g., "I am designed to assist exclusively with retail banking inquiries. For investment advice, please consult a licensed financial advisor."
• Output Block Message: E.g., "The generated response was withheld because it contains unauthorized financial advisory guidance."

---