AWS.Bedrock.MAG: InvokeGuardrailChecks inline-checks policy mode (6/6) - #51
Draft
GarrettBeatty wants to merge 6 commits into
Draft
Conversation
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 18, 2026 16:53
9b68fcb to
158e639
Compare
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 18, 2026 19:12
158e639 to
8ef4c29
Compare
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 19, 2026 15:04
8ef4c29 to
cbdec9d
Compare
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 19, 2026 15:52
cbdec9d to
c2f77fa
Compare
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 19, 2026 17:03
c2f77fa to
ec50070
Compare
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 19, 2026 17:57
ec50070 to
da31750
Compare
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 19, 2026 18:24
da31750 to
3d2bdf0
Compare
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 19, 2026 18:32
3d2bdf0 to
f9e4870
Compare
There was a problem hiding this comment.
Pull request overview
Adds inline Bedrock guardrail checks as an alternative policy-backend mode.
Changes:
- Adds inline-check configuration, request mapping, and response evaluation.
- Selects
ApplyGuardrailor inline checks based on configuration. - Updates the AWS SDK and adds unit/integration coverage.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
InlineChecksPolicyBackendTests.cs |
Tests mode selection and severity decisions. |
InlineChecksIntegrationTests.cs |
Exercises inline PII checks against AWS. |
BedrockGovernanceServiceCollectionExtensions.cs |
Accepts inline policy configuration. |
GuardrailChecksOptions.cs |
Defines checks and thresholds. |
BedrockGuardrailsPolicyOptions.cs |
Exposes inline-check mode. |
BedrockGuardrailsPolicyBackend.cs |
Dispatches and evaluates both modes. |
GuardrailResponseMapper.cs |
Maps check scores to decisions. |
BedrockGuardrailClient.cs |
Builds and invokes inline-check requests. |
AWS.Bedrock.MAG.csproj |
Updates AWSSDK.BedrockRuntime. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+17
to
+29
| [Collection("bedrock-integration")] | ||
| public class InlineChecksIntegrationTests | ||
| { | ||
| private readonly GuardrailFixture _fx; | ||
|
|
||
| public InlineChecksIntegrationTests(GuardrailFixture fx) => _fx = fx; | ||
|
|
||
| private BedrockGuardrailsPolicyBackend Backend() | ||
| { | ||
| var options = new BedrockGuardrailsPolicyOptions | ||
| { | ||
| Region = _fx.Region, | ||
| InlineChecks = new GuardrailChecksOptions { ConfidenceThreshold = 0.1 } |
Comment on lines
+27
to
+30
| public double SeverityThreshold { get; set; } = 0.5; | ||
|
|
||
| /// <summary>PII confidence at or above which the call is denied (0.0 to 1.0).</summary> | ||
| public double ConfidenceThreshold { get; set; } = 0.5; |
Comment on lines
+105
to
+109
| // A finding with no score is treated as meeting the threshold. This is deliberate: an entry only | ||
| // appears in the results when the guardrail flagged something, so a missing score denies (fail-safe) | ||
| // rather than risk letting a real detection through. The trade-off is possible over-blocking if the | ||
| // API ever returns a flagged entry without a score. | ||
| private static bool Meets(double? score, double threshold) => !score.HasValue || score.Value >= threshold; |
Comment on lines
+80
to
+82
| if (checks.PromptAttackCategories.Count > 0) | ||
| { | ||
| config.PromptAttack = new GuardrailChecksPromptAttackConfig |
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 21, 2026 16:29
de7c5f0 to
4c265ae
Compare
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 21, 2026 16:38
4c265ae to
a499807
Compare
Lets the policy backend evaluate tool-call context with inline guardrail checks (content filter, prompt attack, sensitive information) so no pre-created Bedrock guardrail is required, streamlining onboarding (design decision #12). - Bumps AWSSDK.BedrockRuntime to 4.0.101.1 (adds InvokeGuardrailChecks). - GuardrailChecksOptions: categories/entities to check plus severity/confidence thresholds. BedrockGuardrailsPolicyOptions.InlineChecks selects the mode. - BedrockGuardrailClient.InvokeChecksAsync builds/times the request; GuardrailResponseMapper.ChecksTripped maps per-check scores to a deny (fail-safe: a finding with no score is treated as tripped). - The backend uses ApplyGuardrail when GuardrailId is set, else inline checks; ctor and setup validation accept either. Detection only (no masking), so PII sanitization stays on ApplyGuardrail. Tests cover mode selection, allow/deny by threshold, and ctor validation.
Address review: - The XML doc examples used invalid SDK enum values (PROMPT_ATTACK, US_SSN) that would fail-closed on every call if copied. Use real constants (JAILBREAK/PROMPT_INJECTION/PROMPT_LEAKAGE; US_SOCIAL_SECURITY_NUMBER/EMAIL/PHONE). - Expand the comment on ChecksTripped's missing-score handling to make the deliberate fail-safe (deny) trade-off explicit.
- Reject non-finite or out-of-[0,1] SeverityThreshold/ConfidenceThreshold at assignment: Bedrock caps scores at 1.0, so a threshold >1 (or NaN) can never be met and would silently allow every detection (fail-open). - Add mapper tests proving a flagged finding with no score denies (documented fail-safe) for both content-filter severity and PII confidence. - Add a prompt-attack backend test verifying the emitted config and severity-based denial. - Decouple InlineChecksIntegrationTests from the provisioning GuardrailFixture (use IntegrationConfig.Region) so it runs with inline-check-only permissions and truly tests the no-guardrail path.
Grow the README with an Inline guardrail checks subsection covering the GuardrailChecksOptions surface (content-filter/prompt-attack/PII categories, severity/confidence thresholds) and note that InlineChecks composes with every entry point but is detection-only. Add bedrock:InvokeGuardrailChecks to the required IAM and record the new user-facing mode in the autover changelog.
GarrettBeatty
force-pushed
the
gcbeatty/agent-gov-bedrock-invoke-checks
branch
from
August 24, 2026 16:28
a499807 to
2bf391f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 6 of 6 (follow-up). Base:
gcbeatty/agent-gov-bedrock-setup.What
Adds a second guardrail invocation mode to the policy backend: inline checks via
InvokeGuardrailChecks, evaluated without a pre-created Bedrock guardrail (design decision #12).AWSSDK.BedrockRuntimeto 4.0.101.1 (the version that exposesInvokeGuardrailChecks).BedrockGuardrailClient.InvokeChecksAsyncbuilds and times the request;GuardrailResponseMapper.ChecksTrippedmaps per-check scores to allow/deny (fail-safe: a finding with no score is treated as tripped).ApplyGuardrailwhenGuardrailIdis set, otherwise inline checks. When both are set, the pre-created guardrail wins. Ctor and setup validation now accept either.Why
ApplyGuardrailrequires provisioning a guardrail in the Bedrock console/API first. Inline checks let a team evaluate tool-call context out of the box — pick categories and thresholds in code, no AWS resource to create — which lowers the barrier to trying the policy backend and suits ephemeral or per-environment configs.Public API
GuardrailChecksOptions—ContentFilterCategories,PromptAttackCategories,SensitiveInformationEntities, plusSeverityThreshold/ConfidenceThreshold(both validated: reject out-of-range / non-finite) andHasAnyCheck.BedrockGuardrailsPolicyOptions.InlineChecksselects the mode. It composes with every entry point (WithBedrockGovernance,AddBedrockGovernance,AddBedrockGuardrailsPolicy) — set eitherGuardrailIdorInlineChecks.This lets a consumer run the Bedrock policy backend with zero pre-created guardrail resources.
Scope
Policy backend only.
InvokeGuardrailChecksis detection-only (scores + offsets, no masked text), so PII sanitization stays onApplyGuardrail. Block-mode PII via inline checks is a possible further follow-up.Docs & config (incremental)
GuardrailChecksOptionssurface, thresholds, and the detection-only caveat) andbedrock:InvokeGuardrailChecksto the required IAM.AWSSDK.BedrockRuntimebump above.Tests
Mode selection (inline vs guardrail), allow/deny by severity threshold, missing-score fail-safe (content + PII), threshold-setter validation, and ctor validation. Full unit suite: 87 tests pass.
Integration test (real AWS)
Runs the inline-checks mode against real
InvokeGuardrailChecks(no pre-created guardrail): detects an SSN and denies, allows benign.