AI safety, security and governance

Input and output safety

Amazon Bedrock Guardrails

Guardrails evaluate inputs and outputs independently of the model, and can be attached to Converse, InvokeModel, agents and knowledge bases, or used standalone through the ApplyGuardrail API (works with any model, including ones outside Bedrock).

Behaviour to remember: a guardrail can block with a configured message or, for sensitive information, mask. Guardrail versions are immutable and referenced by ID and version; DRAFT is the working copy. Guardrails apply to the text you send them: prompt-attack detection needs the user input tagged (input tags) so that system instructions aren’t treated as attacks. Streaming responses can be checked synchronously (safer, adds latency) or asynchronously (faster, may reveal chunks before blocking). Guardrails act on content; they are not an access-control mechanism and don’t secure the network.

Custom moderation and validation

• Step Functions plus Lambda run custom moderation workflows: classify with Comprehend or a small FM, branch on result, escalate to human review.
• Amazon Comprehend offers toxicity detection, PII detection, sentiment and entity extraction for pre-processing filters.
• FM-as-moderator: a second model call judges toxicity or policy violations of an output (slower and costlier than guardrails; use for nuanced policies).
• Deterministic output paths: when the user asks for data, have the model produce SQL (text-to-SQL) or an API call that runs against a trusted source, instead of generating figures from memory. The numbers come from the database, so they’re reproducible. Validate generated SQL (read-only role, allow-listed tables, parameterised queries).
• Structured outputs: require JSON and validate with JSON Schema in Lambda; reject and retry (or repair) on failure.

Reducing hallucinations

Layers, from strongest to weakest:

1. Ground the answer in retrieved documents (Knowledge Bases) and tell the model to answer only from context and say “I don’t know” otherwise.
2. Cite sources (RetrieveAndGenerate returns citations); show them to users.
3. Contextual grounding checks in Guardrails with a threshold.
4. Verification: semantic similarity between answer sentences and source chunks, confidence scores, fact-checking by a second call, or deterministic checks against a database.
5. Lower temperature and constrained output formats.
6. Automated Reasoning checks where rules are formalisable.

Defence in depth pipeline

Typical layered design:

Adversarial inputs

• Prompt injection: instructions hidden in user input or in retrieved content or tool results (indirect injection). Jailbreaks try to override the rules. Mitigate with guardrail prompt-attack filters, separating trusted instructions from untrusted data (delimiters, tagging), least-privilege tools (an injected instruction can’t do what the tool role can’t do), output validation, and not letting the model’s output become unreviewed code or commands.
• Input sanitisation: strip control characters and hidden text, cap length, normalise encodings.
• Safety classifiers on input and output; automated red-teaming workflows that replay a library of adversarial prompts against each release (a CI stage) and track block rates.
• Treat everything retrieved or returned by tools as untrusted.

Data security and privacy

Protected environments

• VPC endpoints (AWS PrivateLink) keep traffic to Bedrock off the internet. Separate interface endpoints exist for the services: bedrock (control plane), bedrock-runtime (inference), bedrock-agent and bedrock-agent-runtime. Add endpoint policies to restrict which principals and models are allowed. Lambda in a VPC without NAT needs these endpoints to call Bedrock.
• IAM: least privilege on bedrock:InvokeModel* with resource ARNs for specific models or inference profiles; condition keys such as bedrock:GuardrailIdentifier can require a guardrail on every call; SCPs deny unapproved Regions or models; a role per application.
• Encryption: S3, OpenSearch, DynamoDB and logs with KMS customer managed keys; Bedrock supports CMKs for custom models, agents, knowledge base data and evaluation jobs; TLS in transit.
• Bedrock data handling: prompts and completions are not used to train base models and aren’t shared with model providers; model customisation creates a private copy of the model for you, encrypted and not shared.
• Fine-grained data access: AWS Lake Formation (row, column and tag-based access on the data lake), Knowledge Base metadata filters for per-user visibility, separate indexes per tenant.
• Monitoring: CloudWatch metrics and alarms, CloudTrail for API calls, VPC flow logs, S3 access logs.

Privacy-preserving systems

• Detect PII: Amazon Macie scans S3 for sensitive data before it’s ingested into a knowledge base; Comprehend DetectPiiEntities (and PII redaction jobs) in text; Guardrails sensitive-information filters on prompts and responses.
• Mask or anonymise: replace values with placeholders or tokens before the model call and restore them after (tokenisation or pseudonymisation); hash identifiers; remove data that isn’t needed (data minimisation).
• Retention: S3 Lifecycle rules expire logs and conversation transcripts; DynamoDB TTL deletes sessions; define log retention in CloudWatch Logs; honour deletion requests by removing source documents and re-syncing.
• Keep utility: masking preserves format and meaning enough for the model to answer; compare with blanket deletion that removes useful context.

Governance and compliance

• Model cards (SageMaker AI Model Cards) document intended use, training data, evaluation results and limitations, and can be created programmatically. Bedrock provides service cards for AWS models.
• Data lineage and source tracking: AWS Glue Data Catalog registers sources; Glue and lineage tooling record transformations; metadata tags on documents (source, owner, classification) pass through to citations so generated content traces back to origin.
• Audit: CloudTrail records API activity; Bedrock model invocation logging records full prompts and responses to S3 or CloudWatch Logs (off by default; encrypt it and restrict access because it can contain sensitive text); CloudWatch Logs stores decision logs.
• AWS Config, Audit Manager, Security Hub monitor and evidence compliance; AWS Artifact gives AWS compliance reports; Organizations SCPs enforce organisation-wide rules.
• Organisational governance: policies tied to regulation and responsible AI principles, an approval process for new use cases, model and prompt approval workflows, risk tiering, named owners.
• Continuous monitoring: automated detection of misuse, drift in output quality, bias drift and policy violations; alarms and EventBridge-driven remediation (disable a key, switch to a safe fallback, page an owner); token-level redaction in logs; output policy filters.

Responsible AI

• Transparency: show sources and evidence, give user-facing explanations, expose reasoning traces (Bedrock Agents tracing shows steps and tool calls), and publish confidence or uncertainty signals (collect confidence metrics in CloudWatch). Disclose when content is AI generated.
• Fairness: evaluate across demographic slices; use predefined fairness and bias metrics (SageMaker Clarify for models you host); compare prompts or models with Prompt Management variants and Prompt Flows for systematic A/B testing; use LLM-as-a-judge evaluations in Bedrock to score outputs at scale; add human review for sensitive outcomes.
• Policy compliance: Guardrails mapped to written policy; model cards documenting limits; Lambda checks that gate releases on compliance tests.

Common traps

• Believing Guardrails replace IAM or network controls.
• Expecting contextual grounding to work without supplying the source and query separately.
• Turning on invocation logging without encrypting and restricting the log destination.
• Using a public endpoint when the requirement says “no internet”.
• Letting retrieved documents carry instructions into the prompt unfiltered.
• Using Macie on live chat text (it scans S3; use Comprehend or Guardrails for text in flight).