AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 3 / c3.9
Advanced AI Application SecurityDefense-in-depth layer: AI Application Capability 3 · Retrieval-augmented generation (RAG)Use case: AI that connects 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c3.9 Ground and validate responses against retrieved sources

Verify that generated responses are grounded in the approved knowledge base and validate output before use, so hallucinations or injected content do not reach users or downstream systems.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models

Implementation guidance

How to implement on AWS

Enable Bedrock Guardrails contextual grounding to check that responses are semantically consistent with the retrieved, sanctioned sources, and validate/redact output before downstream use. Treat retrieved content as untrusted input and re-apply input filtering.

Acceptance criteria

Responses are checked for grounding against retrieved sources; a fabricated or off-source answer is caught; retrieved context is treated as untrusted.

Practical implementation

How this control is implemented in each reference architecture:

Contextual grounding in the Generative AI account verifies each answer against the retrieved sanctioned sources, and retrieved context is re-filtered as untrusted input.

  1. Enable Bedrock Guardrails contextual grounding so responses are checked for semantic consistency with the retrieved, approved sources.
    Generative AI account Amazon Bedrock
  2. Treat retrieved context as untrusted: re-apply input filtering to it before it reaches the model, since a poisoned document could carry injected instructions.
    Generative AI account Amazon Bedrock
  3. Validate/redact the final output before returning it to the Application account for downstream use.
    Generative AI account → Application account AWS Lambda

How to validate: Responses are grounding-checked against retrieved sources; a fabricated or off-source answer is caught; injected instructions in retrieved context are filtered out.

Avoid: Trusting retrieved documents because they came from 'your' knowledge base. A poisoned document is untrusted input; re-filter it and ground the answer.

Generative AI OU (multi-account) →

Grounding checks and re-filtering of retrieved context in the generative AI tier keep hallucinated or injected content from reaching users.

  1. Enable contextual grounding checks so answers must be consistent with the retrieved approved sources.
    Generative AI tier (IAM role) Amazon Bedrock
  2. Re-apply input filtering to retrieved context before it reaches the model.
    Generative AI tier (IAM role) Amazon Bedrock
  3. Validate/redact the output before the application tier uses it.
    Application tier (IAM role) AWS Lambda

How to validate: Answers are grounding-checked; an off-source answer is caught; retrieved context is treated as untrusted.

Avoid: Returning whatever the model says over retrieved text. Ground the answer and treat retrieved content as untrusted, especially for indirect injection.

Single account (entry point) →

Threats addressed

  • Responses fabricated or not derivable from approved sources.
  • Injected content in retrieved context influencing the answer.

AWS services

Amazon Bedrock Guardrails

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM07 Misinformation
  • LLM08 Hidden Context Exposure
  • LLM10 Improper Output Handling

NIST AI Risk Management Framework (AI 100-1)

  • MEASURE.2 AI systems are evaluated for trustworthy characteristics
  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC02-BP01 Implement guardrails to mitigate harmful or incorrect model responses

Learning resources

References

  • AWS SRA for AI — Capability 3, Input and output validation