Enforce inline-check thresholds and cover fail-safe/prompt-attack paths

- Reject non-finite or out-of-[0,1] SeverityThreshold/ConfidenceThreshold
  at assignment: Bedrock caps scores at 1.0, so a threshold >1 (or NaN)
  can never be met and would silently allow every detection (fail-open).
- Add mapper tests proving a flagged finding with no score denies
  (documented fail-safe) for both content-filter severity and PII
  confidence.
- Add a prompt-attack backend test verifying the emitted config and
  severity-based denial.
- Decouple InlineChecksIntegrationTests from the provisioning
  GuardrailFixture (use IntegrationConfig.Region) so it runs with
  inline-check-only permissions and truly tests the no-guardrail path.

Author: GarrettBeatty

src/AWS.Bedrock.MAG/Policy/GuardrailChecksOptions.cs

@@ -1,6 +1,7 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+using System;
 using System.Collections.Generic;
 
 namespace AWS.Bedrock.MAG
@@ -24,10 +25,33 @@ public sealed class GuardrailChecksOptions
         /// <summary>
         /// Content-filter and prompt-attack severity at or above which the call is denied (0.0 to 1.0).
         /// </summary>
-        public double SeverityThreshold { get; set; } = 0.5;
+        public double SeverityThreshold
+        {
+            get => _severityThreshold;
+            set => _severityThreshold = ValidateThreshold(value, nameof(SeverityThreshold));
+        }
 
         /// <summary>PII confidence at or above which the call is denied (0.0 to 1.0).</summary>
-        public double ConfidenceThreshold { get; set; } = 0.5;
+        public double ConfidenceThreshold
+        {
+            get => _confidenceThreshold;
+            set => _confidenceThreshold = ValidateThreshold(value, nameof(ConfidenceThreshold));
+        }
+
+        private double _severityThreshold = 0.5;
+        private double _confidenceThreshold = 0.5;
+
+        // Bedrock caps these scores at 1.0, so a threshold outside [0, 1] (or NaN) can never be met and would
+        // silently allow every detection through — a fail-open misconfiguration. Reject it at assignment.
+        private static double ValidateThreshold(double value, string name)
+        {
+            if (!double.IsFinite(value) || value < 0.0 || value > 1.0)
+            {
+                throw new ArgumentOutOfRangeException(name, value, "Threshold must be a finite value between 0.0 and 1.0 inclusive.");
+            }
+
+            return value;
+        }
 
         /// <summary>True when at least one category or entity is configured.</summary>
         public bool HasAnyCheck =>

test/AWS.Bedrock.MAG.IntegrationTests/InlineChecksIntegrationTests.cs

@@ -12,20 +12,18 @@ namespace AWS.Bedrock.MAG.IntegrationTests
 {
     /// <summary>
     /// Runs the policy backend in inline-checks mode against real InvokeGuardrailChecks, i.e. with no
-    /// pre-created guardrail (PR: InvokeGuardrailChecks).
+    /// pre-created guardrail (PR: InvokeGuardrailChecks). Deliberately does NOT join the
+    /// "bedrock-integration" collection: the shared fixture provisions a real guardrail and log group, which
+    /// this mode neither needs nor should require, so these tests can run with inline-check-only permissions
+    /// and genuinely exercise the no-pre-created-guardrail path.
     /// </summary>
-    [Collection("bedrock-integration")]
     public class InlineChecksIntegrationTests
     {
-        private readonly GuardrailFixture _fx;
-
-        public InlineChecksIntegrationTests(GuardrailFixture fx) => _fx = fx;
-
-        private BedrockGuardrailsPolicyBackend Backend()
+        private static BedrockGuardrailsPolicyBackend Backend()
         {
             var options = new BedrockGuardrailsPolicyOptions
             {
-                Region = _fx.Region,
+                Region = IntegrationConfig.Region,
                 InlineChecks = new GuardrailChecksOptions { ConfidenceThreshold = 0.1 }
             };
             options.InlineChecks.SensitiveInformationEntities.Add("US_SOCIAL_SECURITY_NUMBER");

test/AWS.Bedrock.MAG.UnitTests/GuardrailResponseMapperTests.cs

@@ -105,5 +105,53 @@ public void SummarizeAssessment_includes_action_and_pii_types()
             Assert.Contains("action=GUARDRAIL_INTERVENED", summary);
             Assert.Contains("NAME", summary);
         }
+
+        [Fact]
+        public void ChecksTripped_treats_a_content_finding_with_no_severity_score_as_tripped()
+        {
+            // Fail-safe: a flagged entry with no score must deny rather than slip through. A very high
+            // threshold ensures the entry only trips because the missing score is treated as meeting it.
+            var response = new InvokeGuardrailChecksResponse
+            {
+                Results = new GuardrailChecksResults
+                {
+                    ContentFilter = new GuardrailChecksContentFilterResult
+                    {
+                        Results = new List<GuardrailChecksContentFilterResultEntry>
+                        {
+                            new() { Category = "HATE" } // SeverityScore deliberately unset (null).
+                        }
+                    }
+                }
+            };
+
+            var tripped = GuardrailResponseMapper.ChecksTripped(response, severityThreshold: 1.0, confidenceThreshold: 1.0, out var summary);
+
+            Assert.True(tripped);
+            Assert.Contains("HATE", summary);
+        }
+
+        [Fact]
+        public void ChecksTripped_treats_a_pii_finding_with_no_confidence_score_as_tripped()
+        {
+            var response = new InvokeGuardrailChecksResponse
+            {
+                Results = new GuardrailChecksResults
+                {
+                    SensitiveInformation = new GuardrailChecksSensitiveInformationResult
+                    {
+                        Results = new List<GuardrailChecksSensitiveInformationResultEntry>
+                        {
+                            new() { Type = "US_SOCIAL_SECURITY_NUMBER" } // ConfidenceScore deliberately unset (null).
+                        }
+                    }
+                }
+            };
+
+            var tripped = GuardrailResponseMapper.ChecksTripped(response, severityThreshold: 1.0, confidenceThreshold: 1.0, out var summary);
+
+            Assert.True(tripped);
+            Assert.Contains("US_SOCIAL_SECURITY_NUMBER", summary);
+        }
     }
 }

test/AWS.Bedrock.MAG.UnitTests/Policy/InlineChecksPolicyBackendTests.cs

@@ -49,6 +49,30 @@ private static BedrockGuardrailsPolicyOptions ContentFilterOptions(double severi
             }
         };
 
+        private static BedrockGuardrailsPolicyOptions PromptAttackOptions(double severityThreshold = 0.5)
+        {
+            var options = new BedrockGuardrailsPolicyOptions
+            {
+                InlineChecks = new GuardrailChecksOptions { SeverityThreshold = severityThreshold }
+            };
+            options.InlineChecks.PromptAttackCategories.Add("PROMPT_INJECTION");
+            return options;
+        }
+
+        private static InvokeGuardrailChecksResponse PromptAttackResult(string category, double severity) => new()
+        {
+            Results = new GuardrailChecksResults
+            {
+                PromptAttack = new GuardrailChecksPromptAttackResult
+                {
+                    Results = new List<GuardrailChecksPromptAttackResultEntry>
+                    {
+                        new() { Category = category, SeverityScore = severity }
+                    }
+                }
+            }
+        };
+
         private static readonly Dictionary<string, object> Context = new() { ["tool"] = "send_email" };
 
         [Fact]
@@ -116,5 +140,33 @@ public async Task Allows_when_score_is_below_the_severity_threshold()
 
             Assert.True(decision.Allowed);
         }
+
+        [Fact]
+        public async Task Emits_prompt_attack_config_and_denies_on_severity()
+        {
+            InvokeGuardrailChecksRequest? captured = null;
+            var mock = Mock(PromptAttackResult("PROMPT_INJECTION", 0.9), r => captured = r);
+            var backend = new BedrockGuardrailsPolicyBackend(PromptAttackOptions(severityThreshold: 0.5), mock.Object);
+
+            var decision = await backend.EvaluateAsync(Context);
+
+            Assert.NotNull(captured);
+            Assert.NotNull(captured!.Checks.PromptAttack);
+            Assert.Single(captured.Checks.PromptAttack.Categories);
+            Assert.False(decision.Allowed);
+            Assert.Contains("PROMPT_INJECTION", decision.Reason);
+        }
+
+        [Theory]
+        [InlineData(-0.1)]
+        [InlineData(1.1)]
+        [InlineData(double.NaN)]
+        [InlineData(double.PositiveInfinity)]
+        public void Threshold_setters_reject_out_of_range_or_non_finite_values(double bad)
+        {
+            // An unenforced threshold > 1 (or NaN) can never be met and would silently allow every detection.
+            Assert.Throws<ArgumentOutOfRangeException>(() => new GuardrailChecksOptions { SeverityThreshold = bad });
+            Assert.Throws<ArgumentOutOfRangeException>(() => new GuardrailChecksOptions { ConfidenceThreshold = bad });
+        }
     }
 }