What's New

Amazon Bedrock AgentCore now integrates Bedrock Guardrails directly into its policy authorization layer, enabling enterprises to enforce real-time safety and security controls at the gateway perimeter for all AI agent interactions. Guardrails evaluate both the outputs of authorized agent actions and the inputs of every call to gateway targets—tools, agents, and models—detecting and blocking prompt injection attacks, harmful content, and sensitive data exposure before they reach downstream systems. This capability is generally available and works with existing AgentCore gateway deployments without requiring new infrastructure.

How It Works

• Gateway-perimeter enforcement: Guardrail evaluations occur at the AgentCore gateway boundary, outside the agent's own code, so security controls are applied consistently regardless of how autonomously the agent behaves.
• Bidirectional content inspection: Guardrails inspect both the inputs flowing into every gateway target call (tools, agents, models) and the outputs produced by every authorized agent action, providing end-to-end coverage within a single agent turn.
• Real-time threat detection: The system detects and blocks prompt injection attacks, harmful or policy-violating content, and sensitive information (e.g., PII) before those payloads reach downstream systems or are returned to users.
• Cedar-based policy engine: Underlying authorization policies are written in Cedar, an open-source policy language, enabling fine-grained, deterministic rules based on user identity and tool input parameters.
• Natural language policy authoring: Developers can describe security rules in plain English; the platform generates candidate Cedar policies, validates them against tool schemas, and uses automated reasoning to flag overly permissive, overly restrictive, or unsatisfiable conditions.
• Observability integration: All policy evaluations—including Guardrail results—are logged through AgentCore's built-in observability layer, supporting auditing, compliance reporting, and iterative policy optimization.
• Consumption-based pricing: Customers are charged per policy evaluation, with no upfront infrastructure commitment required.

Why It's Important

• Closes the agent security gap: Autonomous agents can dynamically chain tool calls in ways that are hard to anticipate; enforcing Guardrails at the platform layer rather than inside agent code eliminates the risk that a manipulated or buggy agent bypasses its own safety logic.
• Prompt injection defense at scale: Prompt injection is one of the most critical attack vectors for agentic AI; evaluating every inbound tool call input in real time provides a systematic, not ad-hoc, defense.
• Sensitive data protection: Guardrails can detect and redact PII or other confidential information in agent outputs before they propagate to downstream APIs, databases, or end users, directly supporting data privacy obligations.
• Consistent policy enforcement: Because controls live outside agent code, the same policy applies uniformly across all agents connected to a gateway, reducing configuration drift and simplifying compliance audits.
• Accelerates enterprise adoption: Security and compliance teams often block production AI agent deployments; a platform-level, auditable guardrail mechanism lowers that barrier significantly.
• Audit-ready logging: Automatic logging of every evaluation via AgentCore observability creates the evidence trail required for regulatory audits and internal governance reviews.

How It's Different

• Outside the agent, not inside it: Unlike safety logic embedded in agent prompts or application code—which can be circumvented through prompt injection or code bugs—AgentCore Guardrails are enforced at the infrastructure perimeter, making them tamper-resistant by design.
• Unified authz + content safety: Most solutions treat authorization (what an agent is allowed to do) and content safety (what content is acceptable) as separate systems; AgentCore combines both in a single policy evaluation at the gateway, reducing latency and operational complexity.
• Automated reasoning on policies: The natural-language policy authoring pipeline uses formal automated reasoning—the same technology underlying AWS IAM and S3 policy analysis—to catch logical errors in policies before they are enforced, a capability not common in competing agent platforms.
• Framework and model agnostic: Guardrails apply regardless of whether the agent is built with LangChain, OpenAI Agents SDK, Strands, or a custom framework, and regardless of the underlying model, avoiding vendor lock-in.
• No new infrastructure required: The feature activates within existing AgentCore gateway deployments, contrasting with solutions that require deploying separate proxy services or security sidecars.
• Bidirectional vs. output-only: Many content-filtering integrations only inspect model outputs; AgentCore Guardrails also inspect inputs to every tool/agent/model call, catching injected payloads before they influence downstream behavior.

When to Prefer It

• Regulated industries (finance, healthcare, legal): When agents handle sensitive data subject to HIPAA, GDPR, PCI-DSS, or similar regulations and you need auditable, platform-enforced data-loss prevention.
• Multi-agent orchestration pipelines: When one agent calls other agents or models, creating a chain where a compromised intermediate agent could propagate malicious instructions; gateway-level inspection breaks that chain.
• Public-facing or customer-service agents: When agents interact with untrusted end users who may attempt prompt injection to exfiltrate data or manipulate agent behavior.
• Enterprise deployments with centralized security governance: When a security or platform team needs to enforce consistent policies across dozens of agent deployments without coordinating changes in each team's application code.
• Rapid production scaling: When you need to move agents from prototype to production quickly and cannot afford the time to build and maintain custom security middleware.
• Compliance audit preparation: When you need a verifiable, immutable log of every agent action and its policy evaluation result to satisfy internal or external audit requirements.
• High-autonomy agents with broad tool access: When agents have access to sensitive APIs, databases, or internal systems and the blast radius of a security failure is large.

Availability

• Status: Generally available (GA) as of June 17, 2026.
• Supported regions: US East (N. Virginia), Europe (London), Europe (Stockholm), Asia Pacific (Sydney), and Asia Pacific (Tokyo).
• Pricing model: Consumption-based pricing per policy evaluation; no upfront infrastructure costs or new infrastructure required.
• Prerequisites: Requires an existing Amazon Bedrock AgentCore gateway deployment; no additional infrastructure provisioning needed.
• Policy authoring: Supported via Cedar policy-as-code or natural language description through the AgentCore console or CLI.
• Documentation: Available at https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html

Related Resources

• https://aws.amazon.com/bedrock/agentcore/
• https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html