Agentic Data Plane
Preview

Create a Guardrail

Create a guardrail to inspect and control the requests and responses that flow through an AWS Bedrock LLM provider. You name the guardrail and pick the Bedrock provider whose credentials and region it inherits, configure the policies on the guardrail’s own page, attach it to a provider, and confirm it blocks.

After reading this page, you will be able to:

  • Create a guardrail and configure its policies

  • Attach the guardrail to an LLM provider and enable it

  • Verify the guardrail blocks a request and trace it through the transcript

Prerequisites

  • An AWS Bedrock LLM provider. In the UI, the guardrail inherits that provider’s credentials and region, so you can’t create a guardrail without one. See Configure an LLM provider.

  • At least one LLM provider to attach the guardrail to. The Agentic Data Plane UI shows the guardrail setting on Bedrock providers only. To attach a guardrail to another provider type, use rpk ai llm-provider update --guardrail. See Configure an LLM provider.

  • For the Sensitive information, Content filters, Contextual grounding, and Automated reasoning policies, confirm the features you need are available in the provider’s Bedrock region.

Create the guardrail

Open Guardrails in the sidebar and click Create guardrail, then fill in the form.

  1. Under Identity, enter a Name. Agentic Data Plane derives the guardrail’s resource ID from the name and shows it under the field. The ID starts with a lowercase letter, uses lowercase letters, numbers, and hyphens, is 1 to 63 characters long, and can’t be changed after creation.

  2. Under Template, select Start blank to create the guardrail with no policies, or start from working policies with Content safety, PII protection, or Prompt attack defense. See Start from a template.

  3. Under Rollout, select Monitor first, the recommended option, to create the guardrail disabled so you can review its policies before anything is enforced, or Enforce now to create it already enabled. Enforce now needs a template, because a guardrail with no policy can’t be enabled.

  4. Under Provider, select the Bedrock LLM provider whose credentials and region the guardrail inherits. The first one is preselected.

  5. Click Create guardrail.

The guardrail’s own page opens on its Overview tab. Both messages that callers see when a policy blocks something start at a default, and you edit them on the Settings tab.

Start from a template

A template seeds a guardrail with working policies for a common goal:

  • Content safety: Blocks hate speech, insults, sexual content, violence, and misconduct at high strength.

  • PII protection: Anonymizes emails, phone numbers, names, addresses, card numbers, and US social security numbers in responses. In prompts, the result depends on the provider. On an AWS Bedrock provider, Bedrock masks each match and sends the masked prompt to the model. On other provider types, a prompt that contains one is blocked and gets your blocked prompt message instead. See Guardrail policy reference.

  • Prompt attack defense: Blocks jailbreaks and prompt-injection attempts before they reach the model.

Templates are a starting point, not a mode. Every value a template seeds stays editable, and applying one never removes rules you already configured.

Configure the policies

Each policy is optional, but a guardrail needs at least one before you can enable it. Configure policies on the guardrail’s Policies tab. For the full configuration of every policy, see Guardrail policy reference.

Each policy is an independent row. Switch a row on to configure that policy, and expand it to edit the rules:

  1. Switch on the policy you need. Agentic Data Plane fills in a default configuration and expands the row.

  2. In the expanded row, start from one of the policy’s quick starts, or click Start from scratch to configure every option yourself.

  3. Edit the rules in the policy’s editor. To clear a policy’s configuration from the draft, click Remove policy.

  4. Click Save and apply in the save bar to persist every change you made across rows. The save bar reports how many LLM providers the save reaches, because saving applies the change to all of them at once. To abandon the draft, click Discard.

Switching a row off keeps that policy’s configuration and stops it being evaluated, which lets you stage a policy or pause one while you troubleshoot. Each row also shows whether the saved policy is live, so you can tell a draft from what the gateway is enforcing. To read what a policy does and what it costs without leaving the page, keep Show guides on.

A policy you switch on needs at least one rule. Agentic Data Plane rejects enabling a guardrail that has no policy configured, and rejects a policy with no rules set, such as a content-filter policy with no category configured or a contextual-grounding policy with neither grounding nor relevance enabled.

Edit the blocked messages

The Settings tab holds what a caller sees and what a reader sees:

  • Message for blocked prompts: Required. What the caller receives when a policy blocks a prompt. 1 to 500 characters.

  • Message for blocked responses: Required. What the caller receives instead of the model’s response when a policy blocks it. Leave Use the same message for blocked responses selected to reuse the prompt message.

  • Display name and Description: Optional. Shown in the list and detail views.

Both messages are reused by every blocking policy in the guardrail, so keep them general. The guardrail’s name and its provider connection are fixed after creation: to change its region or credentials, create a new guardrail.

Click Save to apply your changes, or Discard to abandon them.

Attach the guardrail to a provider

A guardrail takes effect only after a provider references it. A provider references one guardrail, and you can reuse the same guardrail across many providers.

  • On an AWS Bedrock LLM provider, set the guardrail field in the provider’s Bedrock settings to the one you created. The Agentic Data Plane UI shows this field on Bedrock providers only. See Configure an LLM provider.

  • On any provider type, including OpenAI, Anthropic, and Google AI, attach the guardrail with rpk ai:

    rpk ai llm-provider update <provider-name> --guardrail <guardrail-name>

    To detach the guardrail, run the same command with --clear guardrail instead of --guardrail. See rpk ai llm-provider update.

On a Bedrock provider, Bedrock enforces the guardrail as part of the model call. On other provider types, the AI Gateway evaluates requests and responses against the guardrail before it forwards or delivers them.

Enable the guardrail

After you configure the policies and attach the guardrail, click Enable guardrail on the guardrail’s page. Until at least one saved policy is configured, that action stays unavailable and explains why.

A disabled guardrail keeps its configuration and evaluates nothing, which is useful while you stage a policy or troubleshoot whether the guardrail is responsible for unexpected blocks. To stop one policy rather than all of them, switch off that policy instead.

Enabling or disabling a guardrail takes effect within about 30 seconds, because the gateway briefly caches guardrail settings.

Verify the guardrail blocks

Send a request through an attached provider that violates a policy. For example, with the sensitive-information policy set to block on input, send a prompt that contains an email address or other PII.

The request returns your blocked prompt message instead of a model response. Open the request’s transcript and confirm the guardrail recorded its action. See what your agent did walks through reading a transcript, and Review blocked requests shows how blocked requests surface. If the AI Gateway evaluated the guardrail itself, which is the case on a non-Bedrock provider, the call also appears in the audit log as Denied with the guardrail named in the event’s Policies section.

Edit, disable, or delete a guardrail

From the guardrails list or a guardrail’s detail page:

  • Edit the guardrail to change its policies, its blocked messages, or its display name and description. Changes take effect within about 30 seconds, because the gateway briefly caches guardrail settings. The guardrail’s name and its provider connection are fixed after creation.

  • Disable the guardrail to stop evaluation without losing its configuration.

  • Delete the guardrail to remove it permanently.

You cannot delete a guardrail while an LLM provider still references it. Agentic Data Plane blocks the delete and names the providers you must detach first. Open each listed provider, clear its Guardrail field, then delete the guardrail. This protects in-flight traffic: if the guardrail were removed while a provider still pointed at it, every request through that provider would fail.

Next steps