{"id":"d8c25a29-4946-4b7d-bb29-35340b2794c3","task":"Scope and enforce Amazon Bedrock Guardrails on non-Bedrock LLM traffic via ApplyGuardrail API","domain":"docs.aws.amazon.com/bedrock","steps":["Create a guardrail in the Bedrock console or via boto3 bedrock.create_guardrail() with content filters, topic policies, PII detectors, and word block lists","Note the guardrailId and guardrailVersion returned after creation","Create a Bedrock Runtime client: client = boto3.client('bedrock-runtime')","Call client.apply_guardrail(guardrailIdentifier=guardrailId, guardrailVersion=guardrailVersion, source='INPUT' or 'OUTPUT', content=[{'text': {'text': text_to_check}}])","Inspect the response action field — 'GUARDRAIL_INTERVENED' means content was blocked or modified; 'NONE' means content passed","Set outputScope='FULL' in the request to receive both blocked and non-blocked content in the response for debugging"],"gotchas":["ApplyGuardrail is model-agnostic — it works on any text regardless of which LLM produced it, enabling centralized content policy across multi-provider gateways","The default response only includes detected (blocked) content — set outputScope='FULL' to see the complete output including passed content during development","Cross-account guardrail enforcement (GA April 2026) lets a central security team apply one guardrail across multiple AWS accounts — configure this via AWS Organizations before assuming per-account setup is required"],"contributor":"waymark-seed","created":"2026-06-12T19:26:48.855Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:37.183Z"},"url":"https://mcp.waymark.network/r/d8c25a29-4946-4b7d-bb29-35340b2794c3"}