InvokeGuardrailChecks API: Per-Step Safety for AI Agents

import boto3
from strands import Agent, tool
from strands.models import BedrockModel

REGION = "us-east-1"
BLOCK_THRESHOLD = 0.7
WARN_THRESHOLD = 0.4

bedrock = boto3.client("bedrock-runtime", region_name=REGION)

# =============================================================================
# Guardrail helpers — reusable inside any tool
# =============================================================================

def guardrail_check_content(text: str, role: str = "user") -> None:
"""Check text for harmful content + prompt attacks. Raises if blocked."""
response = bedrock.invoke_guardrail_checks(
messages=[{"role": role, "content": [{"text": text}]}],
checks={
"contentFilter": {
"categories": [
{"category": "VIOLENCE"},
{"category": "HATE"},
{"category": "MISCONDUCT"},
]
},
"promptAttack": {
"categories": [
{"category": "JAILBREAK"},
{"category": "PROMPT_INJECTION"},
{"category": "PROMPT_LEAKAGE"},
]
},
},
)

for check_type in ("contentFilter", "promptAttack"):
for entry in response["results"].get(check_type, {}).get("results", []):
score = entry["severityScore"]
if score >= BLOCK_THRESHOLD:
raise ValueError(f"🚫 Blocked: {entry['category']} (severityScore={score})")
elif score >= WARN_THRESHOLD:
print(f" ⚠️ WARNING — {entry['category']} severityScore={score}")

def guardrail_redact_pii(text: str) -> str:
"""Detect PII and redact using character offsets. Returns redacted text."""
response = bedrock.invoke_guardrail_checks(
messages=[{"role": "assistant", "content": [{"text": text}]}],
checks={
"sensitiveInformation": {
"entities": [
{"type": "EMAIL"},
{"type": "PHONE"},
{"type": "US_SOCIAL_SECURITY_NUMBER"},
{"type": "CREDIT_DEBIT_CARD_NUMBER"},
]
},
},
)

pii_results = response["results"]["sensitiveInformation"]["results"]
if not pii_results:
return text

redacted = text
for entity in sorted(pii_results, key=lambda e: e["beginOffset"], reverse=True):
if entity["confidenceScore"] >= WARN_THRESHOLD:
begin, end = entity["beginOffset"], entity["endOffset"]
print(f" 🔒 REDACTED — {entity['type']} confidence={entity['confidenceScore']:.1f}")
redacted = redacted[:begin] + f"[{entity['type']}]" + redacted[end:]
return redacted

# =============================================================================
# Tools with guardrails BUILT IN
# =============================================================================

@tool
def lookup_account(account_id: str) -> str:
"""Look up a customer's bank account details.

Args:
account_id: The customer account number
"""
raw_result = (
f"Account {account_id}: John Smith, "
f"email john.smith@example.com, "
f"SSN 123-45-6789, "
f"balance $45,230.00"
)
# Guardrail: redact PII before returning to the model
return guardrail_redact_pii(raw_result)

@tool
def transfer_funds(from_account: str, to_account: str, amount: float) -> str:
"""Transfer funds between two accounts.

Args:
from_account: Source account number
to_account: Destination account number
amount: Amount in USD to transfer
"""
# Guardrail: screen intent before executing dangerous action
guardrail_check_content(f"Transfer ${amount} from {from_account} to {to_account}")
return f"✅ Transferred ${amount:.2f} from {from_account} to {to_account}."

@tool
def send_email(to: str, subject: str, body: str) -> str:
"""Send an email to a customer.

Args:
to: Recipient email address
subject: Email subject line
body: Email body content
"""
# Guardrail: screen email body for harmful content before sending
guardrail_check_content(body)
# Guardrail: redact any PII in the body
safe_body = guardrail_redact_pii(body)
return f"✅ Email sent to {to} with subject '{subject}'"

# =============================================================================
# Agent — tools handle their own safety
# =============================================================================

agent = Agent(
system_prompt="You are a banking assistant. You can look up accounts, transfer funds, and send emails.",
model=BedrockModel(model_id="us.anthropic.claude-sonnet-4-6", region_name=REGION),
tools=[lookup_account, transfer_funds, send_email],
)

# Just call the agent — tools protect themselves
agent("Look up account 67890")
agent("Send an email to bob@example.com explaining how to rob a bank")