feat: AWS Bedrock Guardrails L5 — topic denial + PII enforcement per Runtime

- server.py: GUARDRAIL_ID env var check on every INPUT + OUTPUT via apply_guardrail()
  Exec Runtime has no GUARDRAIL_ID → unrestricted. Standard Runtime blocked by policy.
  Logs guardrail_block events to DynamoDB for full audit trail.
- main.py: GET /security/guardrails (list Bedrock Guardrails), update_runtime_config
  now writes GUARDRAIL_ID/VERSION as env vars on Runtime update.
  GET /audit/guardrail-events returns guardrail_block DynamoDB records.
  GET /security/runtimes now exposes guardrailId + guardrailVersion per runtime.
- SecurityCenter.tsx: Guardrail dropdown in Runtime Configure modal (auto-populates
  from list_guardrails API), Guardrail badge on RuntimeCard, L5 row in Defense Layers.
- AuditLog.tsx: Guardrail Events tab with per-event actor/policy/direction display,
  enforcement summary counters, guardrail_block added to event type filter.
- useApi.ts: useGuardrails(), useGuardrailEvents() hooks, guardrailId on RuntimeConfig.
- README.md: L5 Guardrail added to security layers table + Flagship Features.
- Demo: CryptoVault-Standard-Policy guardrail (b44c26tk2kds v1) created in us-east-1,
  bound to Standard Runtime via GUARDRAIL_ID env var.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: JiaDe

enterprise/README.md

@@ -42,8 +42,9 @@ Every agent invocation runs in an isolated Firecracker microVM — the same hype
 | L2 — Application | Skills manifest `allowedRoles`/`blockedRoles` | ⚠️ Code bug risk |
 | **L3 — IAM** | **Runtime role has no permission on target resource** | **Impossible** |
 | **L4 — Compute** | **Firecracker microVM per invocation, isolated at hypervisor level** | **Impossible** |
+| **L5 — Guardrail** | **Bedrock Guardrail checks every input + output: topic denial, PII filtering, compliance policies** | **Impossible — AWS-managed, semantic AI layer** |
 
-Each runtime tier has its own Docker image, its own IAM role, and its own Firecracker boundary. An intern's agent IAM role literally cannot read the exec S3 bucket — even if the LLM tries.
+Each runtime tier has its own Docker image, its own IAM role, its own Firecracker boundary, and an optional Bedrock Guardrail. An intern's agent IAM role literally cannot read the exec S3 bucket — even if the LLM tries. And even if it could, the Guardrail blocks the output before it reaches the user.
 
 Additional controls: no public ports (SSM only) · IAM roles throughout, no hardcoded credentials · gateway token in SSM SecureString, never on disk · VPC isolation between runtimes.
 
@@ -77,6 +78,7 @@ Additional controls: no public ports (SSM only) · IAM roles throughout, no hard
 | **Three-Layer SOUL** | Global (IT) → Position (dept admin) → Personal (employee). 3 stakeholders, 3 layers, one merged identity. Same LLM — Finance Analyst vs SDE have completely different personalities and permissions |
 | **Self-Service IM Pairing** | Employee scans QR code from Portal → connects Telegram / Feishu / Discord in 30 seconds. No IT ticket, no admin approval |
 | **Multi-Runtime Architecture** | Standard tier (Nova 2 Lite, scoped IAM) vs Executive tier (Claude Sonnet 4.6, full access). Different Docker images, different models, different IAM roles — infrastructure-level isolation |
+| **Bedrock Guardrails (L5)** | Assign any Bedrock Guardrail to a Runtime from Security Center UI. Topic denial, PII filtering, and compliance policies wrap every user input and agent output — no OpenClaw source code changes needed. Standard employees get blocked; exec tier is unrestricted. Full block audit trail in Audit Center. |
 | **Org Directory KB** | Company directory (every employee, R&R, contact, agent capabilities) seeded from org data and injected into every agent — agents know who to contact and can draft messages for you |
 | **Position → Runtime Routing** | 3-tier routing chain: employee override → position rule → default. Assign positions to runtimes from Security Center UI, propagates to all members automatically |
 | **Per-Employee Model Config** | Override model, context window, compaction settings, and response language at position OR employee level from Agent Factory → Configuration tab |
@@ -198,6 +200,7 @@ Runtime: Executive (C-Suite / Senior Leadership)
 | L2 — Application | Skills manifest `allowedRoles`/`blockedRoles` | ⚠️ Code bug risk |
 | **L3 — IAM** | **Runtime role has no permission on target resource** | **✅ Impossible** |
 | L4 — Network | VPC isolation between Runtimes | ✅ Infrastructure-level |
+| **L5 — Guardrail** | **Bedrock Guardrail per Runtime: topic denial, PII, compliance. Wraps ALL inputs + outputs.** | **✅ Impossible — AWS-managed semantic AI filter** |
 
 #### 3. Digital Twin — AI Availability Beyond Office Hours
 

enterprise/admin-console/server/main.py

@@ -4835,6 +4835,8 @@ def get_security_runtimes(authorization: str = Header(default="")):
                     "region": env.get("AWS_REGION", "us-east-1"),
                     "idleTimeoutSec": lc.get("idleRuntimeSessionTimeout", 900),
                     "maxLifetimeSec": lc.get("maxLifetime", 28800),
+                    "guardrailId": env.get("GUARDRAIL_ID", ""),
+                    "guardrailVersion": env.get("GUARDRAIL_VERSION", ""),
                     "createdAt": detail.get("createdAt", "").isoformat() if hasattr(detail.get("createdAt", ""), "isoformat") else str(detail.get("createdAt", "")),
                     "version": detail.get("agentRuntimeVersion", "1"),
                 })
@@ -4910,6 +4912,16 @@ def update_runtime_config(runtime_id: str, body: dict, authorization: str = Head
             except Exception:
                 pass
 
+        # Guardrail binding: store as env vars; "" means remove guardrail
+        if "guardrailId" in body:
+            gid = body["guardrailId"].strip()
+            if gid:
+                new_env["GUARDRAIL_ID"] = gid
+                new_env["GUARDRAIL_VERSION"] = body.get("guardrailVersion", "DRAFT").strip() or "DRAFT"
+            else:
+                new_env.pop("GUARDRAIL_ID", None)
+                new_env.pop("GUARDRAIL_VERSION", None)
+
         role_arn = body.get("roleArn") or detail["roleArn"]
         idle = body.get("idleTimeoutSec") or detail.get("lifecycleConfiguration", {}).get("idleRuntimeSessionTimeout", 900)
         max_life = body.get("maxLifetimeSec") or detail.get("lifecycleConfiguration", {}).get("maxLifetime", 28800)
@@ -4986,6 +4998,52 @@ def create_runtime(body: CreateRuntimeRequest, authorization: str = Header(defau
         raise HTTPException(500, str(e))
 
 
+# ── Guardrails ───────────────────────────────────────────────────────────────
+
+@app.get("/api/v1/security/guardrails")
+def list_guardrails(authorization: str = Header(default="")):
+    """List all Bedrock Guardrails available in this account/region."""
+    _require_role(authorization, roles=["admin"])
+    try:
+        import boto3 as _b3gr
+        bedrock = _b3gr.client("bedrock", region_name=_GATEWAY_REGION)
+        resp = bedrock.list_guardrails(maxResults=100)
+        guardrails = []
+        for g in resp.get("guardrails", []):
+            guardrails.append({
+                "id": g["id"],
+                "name": g["name"],
+                "status": g.get("status", "READY"),
+                "version": g.get("version", "DRAFT"),
+                "updatedAt": g.get("updatedAt", "").isoformat() if hasattr(g.get("updatedAt", ""), "isoformat") else str(g.get("updatedAt", "")),
+            })
+        return {"guardrails": guardrails}
+    except Exception as e:
+        return {"guardrails": [], "error": str(e)}
+
+
+@app.get("/api/v1/audit/guardrail-events")
+def get_guardrail_events(authorization: str = Header(default=""), limit: int = 50):
+    """Fetch guardrail_block audit events from DynamoDB."""
+    _require_role(authorization, roles=["admin", "manager"])
+    try:
+        table = boto3.resource("dynamodb", region_name=DYNAMODB_REGION).Table(DYNAMODB_TABLE)
+        resp = table.query(
+            IndexName="GSI1",
+            KeyConditionExpression=Key("GSI1PK").eq("TYPE#audit"),
+            ScanIndexForward=False,
+            Limit=limit * 5,  # over-fetch since we filter by eventType
+        )
+        events = [item for item in resp.get("Items", []) if item.get("eventType") == "guardrail_block"]
+        events = events[:limit]
+        for e in events:
+            e.pop("PK", None); e.pop("SK", None)
+            e.pop("GSI1PK", None); e.pop("GSI1SK", None)
+        return {"events": events}
+    except Exception as e:
+        return {"events": [], "error": str(e)}
+
+
 # ── Separate resource endpoints for dropdowns ──────────────────────────────
 
 @app.get("/api/v1/security/ecr-images")

enterprise/admin-console/src/hooks/useApi.ts

@@ -641,9 +641,20 @@ export interface SecurityRuntime {
   id: string; name: string; status: string;
   containerUri: string; roleArn: string; model: string;
   idleTimeoutSec: number; maxLifetimeSec: number;
+  guardrailId?: string; guardrailVersion?: string;
   createdAt: string; version: string;
 }
 
+export interface Guardrail {
+  id: string; name: string; status: string; version: string; updatedAt: string;
+}
+
+export interface GuardrailEvent {
+  id: string; timestamp: string; actorName: string; actorId: string;
+  guardrailId: string; guardrailVersion: string; guardrailSource: string;
+  guardrailPolicy: string; detail: string; status: string;
+}
+
 export function useSecurityRuntimes() {
   return useQuery<{ runtimes: SecurityRuntime[]; error?: string }>({
     queryKey: ['security-runtimes'],
@@ -756,11 +767,29 @@ export function useUpdateRuntimeConfig() {
       runtimeId: string; containerUri?: string; roleArn?: string;
       networkMode?: string; securityGroupIds?: string[]; subnetIds?: string[];
       modelId?: string; idleTimeoutSec?: number; maxLifetimeSec?: number;
+      guardrailId?: string; guardrailVersion?: string;
     }) => api.put(`/security/runtimes/${data.runtimeId}/config`, data),
     onSuccess: () => qc.invalidateQueries({ queryKey: ['security-runtimes'] }),
   });
 }
 
+export function useGuardrails() {
+  return useQuery<{ guardrails: Guardrail[]; error?: string }>({
+    queryKey: ['guardrails'],
+    queryFn: () => api.get('/security/guardrails'),
+    staleTime: 60_000,
+  });
+}
+
+export function useGuardrailEvents(limit = 50) {
+  return useQuery<{ events: GuardrailEvent[]; error?: string }>({
+    queryKey: ['guardrail-events', limit],
+    queryFn: () => api.get(`/audit/guardrail-events?limit=${limit}`),
+    staleTime: 15_000,
+    refetchInterval: 30_000,
+  });
+}
+
 export function useCreateRuntime() {
   const qc = useQueryClient();
   return useMutation({

enterprise/admin-console/src/pages/AuditLog.tsx

@@ -1,12 +1,13 @@
 import { useState, useMemo } from 'react';
 import { useNavigate } from 'react-router-dom';
-import { Shield, Download, Search, AlertTriangle, CheckCircle, XCircle, Info, Clock, Brain, Scan, Loader, Sparkles } from 'lucide-react';
+import { Shield, Download, Search, AlertTriangle, CheckCircle, XCircle, Info, Clock, Brain, Scan, Loader, Sparkles, ShieldAlert, Filter } from 'lucide-react';
 import { Card, Badge, Button, PageHeader, Table, StatCard, Tabs } from '../components/ui';
-import { useAuditEntries, useAuditInsights, useRunAuditScan } from '../hooks/useApi';
+import { useAuditEntries, useAuditInsights, useRunAuditScan, useGuardrailEvents } from '../hooks/useApi';
 import type { AuditEntry } from '../types';
 
 const eventTypeOptions = [
   { label: 'All Events', value: 'all' },
+  { label: 'Guardrail Block', value: 'guardrail_block' },
   { label: 'Agent Invocation', value: 'agent_invocation' },
   { label: 'Tool Execution', value: 'tool_execution' },
   { label: 'Permission Denied', value: 'permission_denied' },
@@ -46,9 +47,11 @@ export default function AuditLog() {
 
   const { data: AUDIT_ENTRIES = [] } = useAuditEntries({ limit: 50, eventType: eventType !== 'all' ? eventType : undefined });
   const { data: insightsData, refetch: refetchInsights } = useAuditInsights();
+  const { data: guardrailData } = useGuardrailEvents(50);
   const runScan = useRunAuditScan();
   const insights = insightsData?.insights || [];
   const insightsSummary = insightsData?.summary;
+  const guardrailEvents = guardrailData?.events || [];
 
   // Compute stats
   const stats = useMemo(() => {
@@ -92,11 +95,12 @@ export default function AuditLog() {
       />
 
       {/* Summary Stats */}
-      <div className="grid grid-cols-2 gap-4 sm:grid-cols-5 mb-6">
+      <div className="grid grid-cols-2 gap-4 sm:grid-cols-6 mb-6">
         <StatCard title="Total Events" value={stats.total} icon={<Shield size={22} />} color="primary" />
         <StatCard title="Agent Invocations" value={stats.invocations} icon={<CheckCircle size={22} />} color="success" />
         <StatCard title="Tool Executions" value={stats.toolExecs} icon={<Clock size={22} />} color="info" />
         <StatCard title="Permission Denied" value={stats.blocked} icon={<XCircle size={22} />} color="danger" />
+        <StatCard title="Guardrail Blocks" value={guardrailEvents.length} icon={<ShieldAlert size={22} />} color="warning" />
         <StatCard title="Config Changes" value={stats.configChanges} icon={<AlertTriangle size={22} />} color="warning" />
       </div>
 
@@ -107,6 +111,7 @@ export default function AuditLog() {
             { id: 'timeline', label: 'Event Timeline', count: filtered.length },
             { id: 'breakdown', label: 'Breakdown' },
             { id: 'security', label: 'Security Alerts', count: stats.blocked || undefined },
+            { id: 'guardrail', label: 'Guardrail Events', count: guardrailEvents.length || undefined },
           ]}
           activeTab={activeTab}
           onChange={setActiveTab}
@@ -327,6 +332,60 @@ export default function AuditLog() {
             </div>
           )}
 
+          {activeTab === 'guardrail' && (
+            <div>
+              <div className="rounded-xl bg-warning/5 border border-warning/20 px-4 py-3 text-xs text-warning mb-4 flex items-center gap-2">
+                <ShieldAlert size={16} />
+                <span>Bedrock Guardrail intercepts — every blocked user input and filtered agent output. Standard Runtime only. Exec Runtime has no guardrail restrictions.</span>
+              </div>
+
+              {guardrailEvents.length === 0 ? (
+                <div className="text-center py-12 text-text-muted">
+                  <ShieldAlert size={32} className="mx-auto mb-3 opacity-30" />
+                  <p className="text-sm">No guardrail blocks yet</p>
+                  <p className="text-xs mt-1">Blocks appear here when Standard Runtime agents trigger topic denial or PII rules.</p>
+                </div>
+              ) : (
+                <div className="space-y-2">
+                  {guardrailEvents.map(e => (
+                    <div key={e.id} className="flex items-start gap-4 rounded-xl bg-amber-500/5 border border-amber-500/20 px-4 py-3">
+                      <ShieldAlert size={18} className="text-amber-400 mt-0.5 shrink-0" />
+                      <div className="flex-1 min-w-0">
+                        <div className="flex items-center gap-2 flex-wrap mb-1">
+                          <span className="text-sm font-semibold text-amber-300">{e.actorName}</span>
+                          <Badge color="warning">{e.guardrailSource === 'INPUT' ? 'Input blocked' : 'Output filtered'}</Badge>
+                          {e.guardrailPolicy && <Badge color="default">{e.guardrailPolicy.replace(/-/g, ' ')}</Badge>}
+                          <span className="text-xs font-mono text-text-muted">{e.guardrailId} v{e.guardrailVersion}</span>
+                        </div>
+                        <p className="text-sm text-text-secondary truncate">{e.detail}</p>
+                        <p className="text-xs text-text-muted mt-1">{new Date(e.timestamp).toLocaleString()}</p>
+                      </div>
+                      <Badge color="danger">Blocked</Badge>
+                    </div>
+                  ))}
+                </div>
+              )}
+
+              <div className="mt-4 rounded-xl bg-dark-bg p-4">
+                <h4 className="text-sm font-medium text-text-primary mb-2">Guardrail Enforcement Summary</h4>
+                <div className="grid grid-cols-3 gap-4 text-center">
+                  <div>
+                    <p className="text-2xl font-semibold text-amber-400">{guardrailEvents.length}</p>
+                    <p className="text-xs text-text-muted">Total Blocks</p>
+                  </div>
+                  <div>
+                    <p className="text-2xl font-semibold text-text-primary">{guardrailEvents.filter(e => e.guardrailSource === 'INPUT').length}</p>
+                    <p className="text-xs text-text-muted">Input Blocked</p>
+                  </div>
+                  <div>
+                    <p className="text-2xl font-semibold text-text-primary">{guardrailEvents.filter(e => e.guardrailSource === 'OUTPUT').length}</p>
+                    <p className="text-xs text-text-muted">Output Filtered</p>
+                  </div>
+                </div>
+              </div>
+            </div>
+          )}
+
           {activeTab === 'security' && (
             <div>
               <p className="text-sm text-text-secondary mb-4">Permission denials and security-relevant events. These indicate policy enforcement working correctly, or potential unauthorized access attempts.</p>