c4.5 Filter tool inputs and outputs with Guardrails
Validate the parameters going into tools and the data coming out, so prompt injection cannot turn tool calls into malicious actions or leak sensitive data.
Implementation guidance
How to implement on AWS
Apply Amazon Bedrock Guardrails to tool inputs and outputs across all integration patterns, blocking malicious parameters, restricted topics, and sensitive-data exposure before tools execute. For AgentCore Gateway integrations, associate a policy engine in enforce mode with the gateway and add guardrail policies that forbid a request when a content filter or prompt attack score passes your threshold, so it is blocked before it reaches the target. Guardrails in policies are available only in some Regions, and scores are probabilistic, so tune thresholds in log-only mode first. Enforce guardrail use for direct Amazon Bedrock invocation with the bedrock:GuardrailIdentifier IAM condition key, so a model call without the approved guardrail is denied.
Acceptance criteria
Guardrails run on tool inputs and outputs; a malicious-parameter attempt is blocked; sensitive data is redacted from tool responses. A direct model invocation without the approved guardrail is denied.
Practical implementation
How this control is implemented in each reference architecture:
Guardrails validate tool parameters going in and data coming out in the Generative AI account, so an injected prompt cannot weaponize a tool call or leak data through a tool response.
- Apply Amazon Bedrock Guardrails to tool inputs and outputs across all integration patterns, blocking malicious parameters and restricted topics before tools execute.Generative AI account
Amazon Bedrock - For AgentCore Gateway integrations, associate a policy engine in enforce mode with the gateway and add guardrail policies that forbid a request when a content filter or prompt attack score passes your threshold, so flagged requests are blocked before they reach the tool. Guardrails in policies are available only in some Regions, and scores are probabilistic, so tune thresholds in log-only mode first.
- Enforce guardrail use, not just configure it. Attach an IAM identity policy that denies bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, bedrock:Converse, and bedrock:ConverseStream unless the bedrock:GuardrailIdentifier condition key matches the approved guardrail and version. To apply a guardrail across OUs or accounts, use an Amazon Bedrock policy in AWS Organizations that points to a versioned guardrail. This applies to direct Amazon Bedrock invocation; keep content guarding comprehensive so callers cannot skip evaluation with guard content tags.Generative AI OU Amazon Bedrock
IAM 
AWS Organizations - Redact sensitive data from tool outputs before they return to the model or the Application account.Generative AI account → Application account Amazon Bedrock
How to validate: Guardrails run on tool inputs and outputs; a malicious-parameter attempt is blocked; sensitive data is redacted from a tool response. A direct model invocation without the approved guardrail is denied.
Avoid: Guarding the chat prompt but not the tool parameters. Injection often targets tool arguments; filter both the inputs and the outputs of every tool.
Guardrails on tool inputs and outputs in the generative AI tier block malicious parameters and redact sensitive data from tool responses.
- Apply Bedrock Guardrails to tool inputs and outputs for every integration pattern.Generative AI tier (IAM role) Amazon Bedrock
- For gateway-mediated tools, associate a policy engine in enforce mode with AgentCore Gateway and add guardrail policies that block a request when a content filter or prompt attack score passes your threshold, before it reaches the tool. Guardrails in policies are available only in some Regions, and scores are probabilistic, so tune thresholds in log-only mode first.
- Enforce guardrail use, not just configure it. Attach an IAM identity policy that denies bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, bedrock:Converse, and bedrock:ConverseStream unless the bedrock:GuardrailIdentifier condition key matches the approved guardrail and version. As an alternative or addition, set account-level guardrail enforcement in each Region you use. This applies to direct Amazon Bedrock invocation. The IAM condition key alone does not stop a caller from skipping prompt evaluation with guard content tags, so set content guarding to comprehensive in the account-level enforcement configuration. Do not use a role with this condition for APIs that call models on your behalf, such as RetrieveAndGenerate, InvokeAgent or InvokeInlineAgent, because some of those internal calls carry no guardrail and are denied.Generative AI tier (IAM role) Amazon Bedrock IAM
- Redact sensitive data from tool outputs before the application tier uses them.Application tier (IAM role) Amazon Bedrock
How to validate: Guardrails run on tool I/O; a malicious parameter is blocked; sensitive data is redacted from responses. A direct model invocation without the approved guardrail is denied.
Avoid: Trusting tool arguments the model produced. Validate parameters and outputs so injection cannot turn a tool into an attack primitive.
Threats addressed
- Prompt injection crafting malicious tool parameters.
- Sensitive data exposed through tool outputs.
AWS services
Amazon Bedrock Guardrails Amazon Bedrock AgentCore Gateway Framework mappings
OWASP GenAI/LLM Top 10 (2026)
- LLM01 Prompt Injection
- LLM03 Excessive Agency
NIST AI Risk Management Framework (AI 100-1)
- MEASURE.2 AI systems are evaluated for trustworthy characteristics
- MANAGE.1 AI risks are prioritized, responded to and managed
AWS Well-Architected Generative AI Lens (Security)
- GENSEC02-BP01 Implement guardrails to mitigate harmful or incorrect model responses
OWASP GenAI Top 10 for Agentic Applications (2025)
- ASI01 Agent Goal Hijack
- ASI02 Tool Misuse and Exploitation
Learning resources
References
- AWS SRA for AI — Capability 4, Data protection