Fix sanitizer fail-closed gap and non-PII audit misclassification

- Fail closed when the guardrail intervenes but the masked output is
  whitespace-only (IsNullOrWhiteSpace, not IsNullOrEmpty); whitespace
  carries no sanitized content and must not be returned as-is.
- Classify the redaction audit event by whether PII entities were
  actually reported: a non-PII intervention (content/topic/word filter)
  is now recorded as a generic guardrail_intervention under the
  bedrock-guardrails policy rather than always claiming pii_redaction.

Author: GarrettBeatty

src/AWS.Bedrock.MAG/Mcp/BedrockGuardrailsSanitizer.cs

@@ -62,9 +62,10 @@ public async Task<SanitizationResult> SanitizeAsync(string text, CancellationTok
             var detected = GuardrailResponseMapper.GetDetectedPiiTypes(response);
             var masked = response.Outputs?.FirstOrDefault()?.Text;
 
-            // Block explicitly, or fail closed when the guardrail intervened but returned no masked text.
-            // Never fall back to the original content: intervention means it was not safe to return as-is.
-            if (_options.BlockOnMatch || string.IsNullOrEmpty(masked))
+            // Block explicitly, or fail closed when the guardrail intervened but returned no usable masked
+            // text (null, empty, or whitespace-only). Never fall back to the original content: intervention
+            // means it was not safe to return as-is, and whitespace-only output carries no sanitized content.
+            if (_options.BlockOnMatch || string.IsNullOrWhiteSpace(masked))
             {
                 return new SanitizationResult { Text = BlockedPlaceholder, RedactedTypes = detected, Blocked = true, Intervened = true };
             }

src/AWS.Bedrock.MAG/Mcp/GovernedBedrockMcpServerTool.cs

@@ -111,7 +111,7 @@ void Track(SanitizationResult sanitized)
                 return result;
             }
 
-            EmitRedaction(redactedTypes, blocked);
+            EmitInterventionEvent(redactedTypes, blocked);
 
             // Scrubbing covers text blocks and embedded text resources. Not scrubbed (documented v1 limits):
             // StructuredContent (sanitizing arbitrary structured JSON is a post-v1 follow-up; callers with PII
@@ -126,23 +126,27 @@ void Track(SanitizationResult sanitized)
             };
         }
 
-        private void EmitRedaction(IReadOnlyCollection<string> redactedTypes, bool blocked)
+        private void EmitInterventionEvent(IReadOnlyCollection<string> redactedTypes, bool blocked)
         {
             if (_audit is null)
             {
                 return;
             }
 
+            // An intervention is either a PII redaction (entities enumerated) or a non-PII policy such as a
+            // content/topic/word filter (no entities). Classify the audit event by what actually fired instead
+            // of always labeling it a PII redaction, which the sanitizer explicitly supports for non-PII cases.
+            var isPii = redactedTypes.Count > 0;
             var toolName = _inner.ProtocolTool.Name;
             _audit.Emit(new GovernanceEvent
             {
                 Type = GovernanceEventType.PolicyViolation,
                 AgentId = $"mcp-tool:{toolName}",
                 SessionId = "mcp-response-sanitization",
-                PolicyName = "bedrock-guardrails-pii",
+                PolicyName = isPii ? "bedrock-guardrails-pii" : "bedrock-guardrails",
                 Data =
                 {
-                    ["kind"] = "pii_redaction",
+                    ["kind"] = isPii ? "pii_redaction" : "guardrail_intervention",
                     ["tool"] = toolName,
                     ["entities"] = string.Join(",", redactedTypes),
                     ["blocked"] = blocked

test/AWS.Bedrock.MAG.UnitTests/Mcp/BedrockGuardrailsSanitizerTests.cs

@@ -159,5 +159,33 @@ public async Task Fails_closed_when_intervened_but_no_masked_output()
             Assert.True(result.Blocked);
             Assert.DoesNotContain("123-45-6789", result.Text);
         }
+
+        [Fact]
+        public async Task Fails_closed_when_intervened_but_masked_output_is_whitespace_only()
+        {
+            // Whitespace-only masked output carries no sanitized content; treating it as valid would return an
+            // effectively empty result for content the guardrail flagged as unsafe. Must fail closed.
+            var response = new ApplyGuardrailResponse
+            {
+                Action = GuardrailAction.GUARDRAIL_INTERVENED,
+                Outputs = new List<GuardrailOutputContent> { new() { Text = "   \t\n" } },
+                Assessments = new List<GuardrailAssessment>
+                {
+                    new GuardrailAssessment
+                    {
+                        SensitiveInformationPolicy = new GuardrailSensitiveInformationPolicyAssessment
+                        {
+                            PiiEntities = new List<GuardrailPiiEntityFilter> { new() { Type = new GuardrailPiiEntityType("US_SSN") } }
+                        }
+                    }
+                }
+            };
+            var sanitizer = Sanitizer(Mock(response).Object);
+
+            var result = await sanitizer.SanitizeAsync("SSN 123-45-6789");
+
+            Assert.True(result.Blocked);
+            Assert.DoesNotContain("123-45-6789", result.Text);
+        }
     }
 }

test/AWS.Bedrock.MAG.UnitTests/Mcp/GovernedBedrockMcpServerToolTests.cs

@@ -91,9 +91,35 @@ public async Task Emits_governance_event_on_redaction()
             var evt = Assert.Single(captured);
             Assert.Equal(GovernanceEventType.PolicyViolation, evt.Type);
             Assert.Equal("pii_redaction", evt.Data["kind"]);
+            Assert.Equal("bedrock-guardrails-pii", evt.PolicyName);
             Assert.Contains("US_SSN", evt.Data["entities"]!.ToString());
         }
 
+        [Fact]
+        public async Task Emits_generic_intervention_event_when_no_pii_entities()
+        {
+            // A non-PII intervention (content/topic/word filter) masks text but enumerates no PII entities.
+            // The audit event must be classified as a generic guardrail intervention, not a PII redaction.
+            var response = new ApplyGuardrailResponse
+            {
+                Action = GuardrailAction.GUARDRAIL_INTERVENED,
+                Outputs = new List<GuardrailOutputContent> { new() { Text = "[filtered]" } }
+            };
+            var inner = new StubTool("lookup", TextResult("some banned content"));
+            var sanitizer = Sanitizer(BedrockReturning(response));
+            var emitter = new AuditEmitter();
+            var captured = new List<GovernanceEvent>();
+            emitter.OnAll(captured.Add);
+
+            var tool = new GovernedBedrockMcpServerTool(inner, sanitizer, emitter);
+            await tool.InvokeAsync(McpTest.Request());
+
+            var evt = Assert.Single(captured);
+            Assert.Equal("guardrail_intervention", evt.Data["kind"]);
+            Assert.Equal("bedrock-guardrails", evt.PolicyName);
+            Assert.Equal(string.Empty, evt.Data["entities"]!.ToString());
+        }
+
         [Fact]
         public async Task Sanitizes_multiple_text_blocks_and_preserves_non_text_blocks()
         {