Add InvokeGuardrailChecks (inline checks) mode to the policy backend

Lets the policy backend evaluate tool-call context with inline guardrail checks
(content filter, prompt attack, sensitive information) so no pre-created Bedrock
guardrail is required, streamlining onboarding (design decision #12).

- Bumps AWSSDK.BedrockRuntime to 4.0.101.1 (adds InvokeGuardrailChecks).
- GuardrailChecksOptions: categories/entities to check plus severity/confidence
  thresholds. BedrockGuardrailsPolicyOptions.InlineChecks selects the mode.
- BedrockGuardrailClient.InvokeChecksAsync builds/times the request;
  GuardrailResponseMapper.ChecksTripped maps per-check scores to a deny
  (fail-safe: a finding with no score is treated as tripped).
- The backend uses ApplyGuardrail when GuardrailId is set, else inline checks;
  ctor and setup validation accept either. Detection only (no masking), so PII
  sanitization stays on ApplyGuardrail.

Tests cover mode selection, allow/deny by threshold, and ctor validation.

Author: GarrettBeatty

src/AWS.Bedrock.MAG/AWS.Bedrock.MAG.csproj

@@ -29,7 +29,7 @@
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="AWSSDK.BedrockRuntime" Version="4.0.17.5" />
+        <PackageReference Include="AWSSDK.BedrockRuntime" Version="4.0.101.1" />
         <PackageReference Include="AWS.Logger.Core" Version="4.0.3" />
         <PackageReference Include="AWSSDK.CloudWatch" Version="4.0.103.2" />
         <PackageReference Include="Microsoft.AgentGovernance" Version="5.0.0" />

src/AWS.Bedrock.MAG/Internal/BedrockGuardrailClient.cs

@@ -4,6 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Amazon.BedrockRuntime;
@@ -56,8 +57,71 @@ public async Task<GuardrailInvocation> ApplyAsync(
 
             return new GuardrailInvocation(response, evaluationMs);
         }
+
+        /// <summary>
+        /// Runs inline guardrail checks (InvokeGuardrailChecks) over a single block of text and returns the
+        /// response plus the elapsed time. No pre-created guardrail is required.
+        /// </summary>
+        public async Task<GuardrailChecksInvocation> InvokeChecksAsync(
+            GuardrailChecksOptions checks,
+            string text,
+            CancellationToken cancellationToken = default)
+        {
+            var config = new GuardrailChecksConfig();
+            if (checks.ContentFilterCategories.Count > 0)
+            {
+                config.ContentFilter = new GuardrailChecksContentFilterConfig
+                {
+                    Categories = checks.ContentFilterCategories
+                        .Select(c => new GuardrailChecksContentFilterCategoryConfig { Category = c }).ToList()
+                };
+            }
+
+            if (checks.PromptAttackCategories.Count > 0)
+            {
+                config.PromptAttack = new GuardrailChecksPromptAttackConfig
+                {
+                    Categories = checks.PromptAttackCategories
+                        .Select(c => new GuardrailChecksPromptAttackCategoryConfig { Category = c }).ToList()
+                };
+            }
+
+            if (checks.SensitiveInformationEntities.Count > 0)
+            {
+                config.SensitiveInformation = new GuardrailChecksSensitiveInformationConfig
+                {
+                    Entities = checks.SensitiveInformationEntities
+                        .Select(e => new GuardrailChecksSensitiveInformationEntityConfig { Type = e }).ToList()
+                };
+            }
+
+            var request = new InvokeGuardrailChecksRequest
+            {
+                Checks = config,
+                Messages = new List<GuardrailChecksMessage>
+                {
+                    new GuardrailChecksMessage
+                    {
+                        Role = "user",
+                        Content = new List<GuardrailChecksContentBlock>
+                        {
+                            new GuardrailChecksContentBlock { Text = text }
+                        }
+                    }
+                }
+            };
+
+            var start = Stopwatch.GetTimestamp();
+            var response = await _client.InvokeGuardrailChecksAsync(request, cancellationToken).ConfigureAwait(false);
+            var evaluationMs = Stopwatch.GetElapsedTime(start).TotalMilliseconds;
+
+            return new GuardrailChecksInvocation(response, evaluationMs);
+        }
     }
 
     /// <summary>A guardrail response paired with how long the round-trip took, in milliseconds.</summary>
     internal readonly record struct GuardrailInvocation(ApplyGuardrailResponse Response, double EvaluationMs);
+
+    /// <summary>An inline-checks response paired with how long the round-trip took, in milliseconds.</summary>
+    internal readonly record struct GuardrailChecksInvocation(InvokeGuardrailChecksResponse Response, double EvaluationMs);
 }

src/AWS.Bedrock.MAG/Internal/GuardrailResponseMapper.cs

@@ -57,5 +57,51 @@ public static string SummarizeAssessment(ApplyGuardrailResponse response)
                 ? $"action={action}"
                 : $"action={action}; pii=[{string.Join(",", pii)}]";
         }
+
+        /// <summary>
+        /// Evaluates an inline-checks (InvokeGuardrailChecks) response. A content-filter or prompt-attack
+        /// finding trips when its severity meets <paramref name="severityThreshold"/>; a PII finding trips
+        /// when its confidence meets <paramref name="confidenceThreshold"/>. A finding with no score is
+        /// treated as tripped (fail-safe). Returns true when any check tripped, with a summary of which.
+        /// </summary>
+        public static bool ChecksTripped(
+            InvokeGuardrailChecksResponse response,
+            double severityThreshold,
+            double confidenceThreshold,
+            out string summary)
+        {
+            var tripped = new List<string>();
+            var results = response.Results;
+
+            if (results?.ContentFilter?.Results is { } contentFilter)
+            {
+                foreach (var entry in contentFilter.Where(e => Meets(e.SeverityScore, severityThreshold)))
+                {
+                    tripped.Add($"content:{entry.Category}");
+                }
+            }
+
+            if (results?.PromptAttack?.Results is { } promptAttack)
+            {
+                foreach (var entry in promptAttack.Where(e => Meets(e.SeverityScore, severityThreshold)))
+                {
+                    tripped.Add($"promptAttack:{entry.Category}");
+                }
+            }
+
+            if (results?.SensitiveInformation?.Results is { } sensitive)
+            {
+                foreach (var entry in sensitive.Where(e => Meets(e.ConfidenceScore, confidenceThreshold)))
+                {
+                    tripped.Add($"pii:{entry.Type}");
+                }
+            }
+
+            summary = tripped.Count == 0 ? "no checks tripped" : string.Join(",", tripped);
+            return tripped.Count > 0;
+        }
+
+        // A finding with no score is treated as meeting the threshold (fail-safe toward deny).
+        private static bool Meets(double? score, double threshold) => !score.HasValue || score.Value >= threshold;
     }
 }

src/AWS.Bedrock.MAG/Policy/BedrockGuardrailsPolicyBackend.cs

@@ -37,9 +37,14 @@ public sealed class BedrockGuardrailsPolicyBackend : IExternalPolicyBackend
         public BedrockGuardrailsPolicyBackend(BedrockGuardrailsPolicyOptions options, IAmazonBedrockRuntime? client = null)
         {
             _options = options ?? throw new ArgumentNullException(nameof(options));
-            if (string.IsNullOrWhiteSpace(_options.GuardrailId))
+
+            var hasGuardrail = !string.IsNullOrWhiteSpace(_options.GuardrailId);
+            var hasInlineChecks = _options.InlineChecks?.HasAnyCheck == true;
+            if (!hasGuardrail && !hasInlineChecks)
             {
-                throw new ArgumentException($"{nameof(BedrockGuardrailsPolicyOptions)}.{nameof(BedrockGuardrailsPolicyOptions.GuardrailId)} must be set.", nameof(options));
+                throw new ArgumentException(
+                    "Set either GuardrailId (ApplyGuardrail) or InlineChecks with at least one category/entity (InvokeGuardrailChecks).",
+                    nameof(options));
             }
 
             _client = new BedrockGuardrailClient(client ?? CreateClient(_options.Region, _options.Credentials));
@@ -67,30 +72,57 @@ public async Task<ExternalPolicyDecision> EvaluateAsync(IReadOnlyDictionary<stri
                 // instead of escaping to the (sync) PolicyEngine and breaking the whole governance call.
                 var text = (_options.ContextSerializer ?? DefaultContextSerializer)(context);
 
-                var invocation = await _client
-                    .ApplyAsync(_options.GuardrailId!, _options.GuardrailVersion, GuardrailContentSource.INPUT, text, cancellationToken)
-                    .ConfigureAwait(false);
-
-                var intervened = GuardrailResponseMapper.Intervened(invocation.Response);
-                var summary = GuardrailResponseMapper.SummarizeAssessment(invocation.Response);
-
-                return new ExternalPolicyDecision
-                {
-                    Backend = Name,
-                    Allowed = !intervened,
-                    Reason = intervened
-                        ? $"Denied by Bedrock guardrail ({summary})."
-                        : "Allowed by Bedrock guardrail.",
-                    EvaluationMs = invocation.EvaluationMs,
-                    Metadata = new Dictionary<string, object> { ["assessment"] = summary }
-                };
+                // A configured guardrail (ApplyGuardrail) wins; otherwise run inline checks.
+                return string.IsNullOrWhiteSpace(_options.GuardrailId)
+                    ? await EvaluateWithInlineChecksAsync(text, cancellationToken).ConfigureAwait(false)
+                    : await EvaluateWithGuardrailAsync(text, cancellationToken).ConfigureAwait(false);
             }
             catch (Exception ex)
             {
                 return BuildErrorDecision(ex);
             }
         }
 
+        private async Task<ExternalPolicyDecision> EvaluateWithGuardrailAsync(string text, CancellationToken cancellationToken)
+        {
+            var invocation = await _client
+                .ApplyAsync(_options.GuardrailId!, _options.GuardrailVersion, GuardrailContentSource.INPUT, text, cancellationToken)
+                .ConfigureAwait(false);
+
+            var intervened = GuardrailResponseMapper.Intervened(invocation.Response);
+            var summary = GuardrailResponseMapper.SummarizeAssessment(invocation.Response);
+
+            return new ExternalPolicyDecision
+            {
+                Backend = Name,
+                Allowed = !intervened,
+                Reason = intervened
+                    ? $"Denied by Bedrock guardrail ({summary})."
+                    : "Allowed by Bedrock guardrail.",
+                EvaluationMs = invocation.EvaluationMs,
+                Metadata = new Dictionary<string, object> { ["assessment"] = summary }
+            };
+        }
+
+        private async Task<ExternalPolicyDecision> EvaluateWithInlineChecksAsync(string text, CancellationToken cancellationToken)
+        {
+            var checks = _options.InlineChecks!;
+            var invocation = await _client.InvokeChecksAsync(checks, text, cancellationToken).ConfigureAwait(false);
+            var tripped = GuardrailResponseMapper.ChecksTripped(
+                invocation.Response, checks.SeverityThreshold, checks.ConfidenceThreshold, out var summary);
+
+            return new ExternalPolicyDecision
+            {
+                Backend = Name,
+                Allowed = !tripped,
+                Reason = tripped
+                    ? $"Denied by Bedrock inline checks ({summary})."
+                    : "Allowed by Bedrock inline checks.",
+                EvaluationMs = invocation.EvaluationMs,
+                Metadata = new Dictionary<string, object> { ["checks"] = summary }
+            };
+        }
+
         // Fail-closed: set BOTH Error and Allowed=false so the engine denies (engine denies when
         // !IsNullOrWhiteSpace(Error) || !Allowed). Fail-open: Allowed=true and leave Error EMPTY, or the
         // engine would still deny; the error is kept in Metadata for the audit.

src/AWS.Bedrock.MAG/Policy/BedrockGuardrailsPolicyOptions.cs

@@ -13,12 +13,22 @@ namespace AWS.Bedrock.MAG
     /// </summary>
     public sealed class BedrockGuardrailsPolicyOptions
     {
-        /// <summary>The guardrail identifier (ID or ARN) to evaluate tool-call context against. Required.</summary>
+        /// <summary>
+        /// The guardrail identifier (ID or ARN) to evaluate tool-call context against via ApplyGuardrail.
+        /// Set this or <see cref="InlineChecks"/>. When both are set, the configured guardrail wins.
+        /// </summary>
         public string? GuardrailId { get; set; }
 
         /// <summary>The guardrail version to apply. Defaults to the mutable working draft.</summary>
         public string GuardrailVersion { get; set; } = "DRAFT";
 
+        /// <summary>
+        /// Inline guardrail checks (InvokeGuardrailChecks), used when <see cref="GuardrailId"/> is not set.
+        /// The checks are defined in the request, so no pre-created guardrail is required. Detection only:
+        /// a tripped check denies the call (this mode does not mask text).
+        /// </summary>
+        public GuardrailChecksOptions? InlineChecks { get; set; }
+
         /// <summary>
         /// Serializes the tool-call context (tool name and arguments the toolkit passes) into the text
         /// handed to the guardrail. Defaults to a compact JSON object, matching the toolkit's OPA and

src/AWS.Bedrock.MAG/Policy/GuardrailChecksOptions.cs

@@ -0,0 +1,36 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+using System.Collections.Generic;
+
+namespace AWS.Bedrock.MAG
+{
+    /// <summary>
+    /// Configures inline guardrail checks for the policy backend (InvokeGuardrailChecks). The checks are
+    /// supplied in the request, so no pre-created Bedrock guardrail is needed. At least one category or
+    /// entity must be set. A check trips the deny when its score meets the matching threshold.
+    /// </summary>
+    public sealed class GuardrailChecksOptions
+    {
+        /// <summary>Content-filter categories to evaluate (e.g. HATE, INSULTS, SEXUAL, VIOLENCE, MISCONDUCT).</summary>
+        public IList<string> ContentFilterCategories { get; } = new List<string>();
+
+        /// <summary>Prompt-attack categories to evaluate (e.g. PROMPT_ATTACK).</summary>
+        public IList<string> PromptAttackCategories { get; } = new List<string>();
+
+        /// <summary>PII entity types to detect (e.g. US_SSN, EMAIL, NAME).</summary>
+        public IList<string> SensitiveInformationEntities { get; } = new List<string>();
+
+        /// <summary>
+        /// Content-filter and prompt-attack severity at or above which the call is denied (0.0 to 1.0).
+        /// </summary>
+        public double SeverityThreshold { get; set; } = 0.5;
+
+        /// <summary>PII confidence at or above which the call is denied (0.0 to 1.0).</summary>
+        public double ConfidenceThreshold { get; set; } = 0.5;
+
+        /// <summary>True when at least one category or entity is configured.</summary>
+        public bool HasAnyCheck =>
+            ContentFilterCategories.Count > 0 || PromptAttackCategories.Count > 0 || SensitiveInformationEntities.Count > 0;
+    }
+}

src/AWS.Bedrock.MAG/Setup/BedrockGovernanceServiceCollectionExtensions.cs

@@ -71,9 +71,12 @@ internal static void Normalize(BedrockGovernanceOptions options)
 
         internal static void Validate(BedrockGovernanceOptions options)
         {
-            if (options.EnablePolicy && string.IsNullOrWhiteSpace(options.Policy.GuardrailId))
+            if (options.EnablePolicy
+                && string.IsNullOrWhiteSpace(options.Policy.GuardrailId)
+                && options.Policy.InlineChecks?.HasAnyCheck != true)
             {
-                throw new InvalidOperationException("EnablePolicy is true but Policy.GuardrailId is not set.");
+                throw new InvalidOperationException(
+                    "EnablePolicy is true but neither Policy.GuardrailId nor Policy.InlineChecks is configured.");
             }
 
             if (options.EnablePiiSanitization && string.IsNullOrWhiteSpace(options.Sanitization.GuardrailId))