AWS: New Bedrock InvokeGuardrailChecks API Brings Safety Checks Without Resources for Agentic Applications
AWS introduced InvokeGuardrailChecks in Amazon Bedrock, a detection API that returns scores without automatically blocking and without requiring a pre-created guardrail resource. It covers three protections: content filters, prompt attack detection (jailbreak, injection, leakage) and PII recognition with 31 entity types. The API returns severity and confidence scores on a scale of 0 to 1.0, designed for multi-step agentic loops where the development team controls the thresholds.
This article was generated using artificial intelligence from primary sources.
AWS introduced InvokeGuardrailChecks in Amazon Bedrock, an API that enables agentic applications to perform safety checks without managing separate resources.
What makes the new API different?
InvokeGuardrailChecks is a detect-only API: it returns risk scores but does not automatically block — the development team decides what to do with the result. Additionally, it does not require a pre-created guardrail resource, eliminating the operational overhead of managing multiple versioned guardrails. A guardrail is a layer that checks model inputs and outputs for safety and compliance.
What protections does it cover?
The API covers three types of checks: content filters (hate, violence, sexual content, insults, misconduct), prompt attack detection (jailbreak, prompt injection, data leakage) and PII (Personally Identifiable Information) recognition with 31 entity types. It returns severity and confidence scores on a scale of 0 to 1.0, and for PII also character positions in the text.
Why is this important for agentic systems?
Agentic applications operate in multiple steps, so safety must be checked at each iteration of the loop. Because the API returns scores rather than hard blocking, development teams can set their own thresholds per step — stricter where the agent calls sensitive tools, more lenient elsewhere. This embeds security granularly, without the overhead of multiple guardrail resources.
Frequently Asked Questions
- What does the InvokeGuardrailChecks API do?
- It detects risks and returns scores without automatically blocking and requires no pre-created guardrail resource.
- What protections does it cover?
- Content filters, prompt attack detection (jailbreak, injection, leakage) and PII recognition with 31 entity types.