Agentic Data Plane

rpk ai guardrail create

Create a Guardrail.

Choose the config by setting flags from one group; the group you use selects it: bedrock-config, local-config. Setting flags from two groups is an error.

This command was introduced in ai version 0.2.94.

Usage

rpk ai guardrail create [flags]

Examples

This section provides examples of how to use rpk ai guardrail create.

rpk ai guardrail create my-guardrail \
  --blocked-input-message Your request was blocked by a content policy. \
  --blocked-output-message The response was blocked by a content policy. \
  --bedrock-config.backend.region us-east-1

Flags

Value Type Description

--display-name

string

Name shown in the UI, up to 253 characters. Defaults to the identifier.

--description

string

Notes shown with the guardrail in the UI, up to 1,024 characters.

--blocked-input-message

string

Returned when an input policy blocks a prompt. 1 to 500 characters. Shared by every input-blocking policy. (required).

--blocked-output-message

string

Returned when an output policy blocks a response. 1 to 500 characters. Shared by every output-blocking policy. (required).

--enabled

bool

Turns the whole guardrail on or off. While off, no policy runs and configuration is kept. Changes take effect within about 30 seconds. (true when set; pass --enabled=false to disable).

--bedrock-config.backend.region

string

AWS region where the Bedrock guardrail is created, for example us-east-1. Content filters, contextual grounding, and automated reasoning aren’t available in every region. (required in its group).

--bedrock-config.backend.llm-provider-ref

string

Supplies AWS credentials and region. Selecting a provider doesn’t attach the guardrail to it.

--bedrock-config.backend.standalone.default-chain

bool

Default chain. (selects this credentials mode; takes no value).

--bedrock-config.backend.standalone.static-credentials.access-key-id-ref

string

Secret store key that holds the AWS access key ID, in UPPER_SNAKE_CASE (for example, AWS_ACCESS_KEY_ID). The credentials need permission to manage Bedrock guardrails in the configured region. (required in its group).

--bedrock-config.backend.standalone.static-credentials.secret-access-key-ref

string

Secret store key that holds the AWS secret access key, in UPPER_SNAKE_CASE (for example, AWS_SECRET_ACCESS_KEY). (required in its group).

--bedrock-config.backend.standalone.assume-role.role-arn

string

ARN of the IAM role to assume through STS (arn:aws:iam::<account-id>:role/<role-name>). The trust policy must allow Redpanda to assume the role, and the role must be able to manage Bedrock guardrails in the configured region. (required in its group).

--bedrock-config.backend.standalone.assume-role.external-id

string

External ID passed to STS. Required only when the role’s trust policy sets a condition on sts:ExternalId, and must match it exactly.

--bedrock-config.backend.standalone.assume-role.session-name

string

Session name recorded in CloudTrail for calls this guardrail makes. Defaults to a Redpanda-supplied name.

--bedrock-config.content-filter-policy.enabled

bool

Turns all content categories on or off. Configuration is kept while off. Categories run only while the guardrail is enabled. (true when set; pass --bedrock-config.content-filter-policy.enabled=false to disable).

--bedrock-config.content-filter-policy.hate.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.hate.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.hate.input.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.hate.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.hate.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.hate.output.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.insults.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.insults.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.insults.input.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.insults.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.insults.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.insults.output.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.sexual.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.sexual.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.sexual.input.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.sexual.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.sexual.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.sexual.output.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.violence.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.violence.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.violence.input.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.violence.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.violence.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.violence.output.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.misconduct.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.misconduct.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.misconduct.input.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.misconduct.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.misconduct.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.misconduct.output.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.prompt-attack.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.prompt-attack.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.prompt-attack.input.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.content-filter-policy.prompt-attack.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--bedrock-config.content-filter-policy.prompt-attack.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--bedrock-config.content-filter-policy.prompt-attack.output.modalities

strings

Content types to inspect. Text only when empty. Image requires a region and model with multimodal guardrail support. (one of: text, image; repeatable; replaces the full list on update).

--bedrock-config.word-filter-policy.enabled

bool

Turns word filtering on or off. Configuration is kept while off. Matching is exact and case-insensitive, so misspellings and paraphrases don’t match. (true when set; pass --bedrock-config.word-filter-policy.enabled=false to disable).

--bedrock-config.word-filter-policy.custom-words

stringArray

Custom word groups. Every word in a group shares the group’s input and output action. Up to 10,000 words across all groups. (repeatable; protojson object; replaces the full list on update).

--bedrock-config.word-filter-policy.managed-lists

stringArray

Platform-curated word lists, such as the AWS-managed profanity list, with an action per direction. (repeatable; protojson object; replaces the full list on update).

--bedrock-config.denied-topics-policy.enabled

bool

Turns denied topics on or off. Configuration is kept while off. Matching is semantic, so paraphrases and misspellings match. (true when set; pass --bedrock-config.denied-topics-policy.enabled=false to disable).

--bedrock-config.denied-topics-policy.topics

stringArray

Topics denied by meaning, each with a name, definition, and optional examples. 1 to 30 topics. (repeatable; name (bare values comma-split) or protojson object; replaces the full list on update).

--bedrock-config.pii-filter-policy.enabled

bool

Turns sensitive-information detection on or off. Configuration is kept while off. (true when set; pass --bedrock-config.pii-filter-policy.enabled=false to disable).

--bedrock-config.pii-filter-policy.entities

stringArray

Rules for the 31 built-in entity types, such as email address, phone number, credit card number, or US Social Security number. One rule per type. (repeatable; protojson object; replaces the full list on update).

--bedrock-config.pii-filter-policy.regexes

stringArray

RE2 patterns for identifiers the built-in types don’t cover, such as internal account IDs. Bedrock doesn’t support lookahead or lookbehind. (repeatable; name (bare values comma-split) or protojson object; replaces the full list on update).

--bedrock-config.grounding-policy.enabled

bool

Turns contextual grounding on or off. Configuration is kept while off. Checks run on output only and require a grounding source and query in the request. (true when set; pass --bedrock-config.grounding-policy.enabled=false to disable).

--bedrock-config.grounding-policy.grounding.enabled

bool

Turns this check on or off independently. Configuration is kept while off. (true when set; pass --bedrock-config.grounding-policy.grounding.enabled=false to disable).

--bedrock-config.grounding-policy.grounding.threshold

float

Minimum score from 0.0 to 0.99. The action fires below it. Higher values flag more responses.

--bedrock-config.grounding-policy.grounding.action

string

Action on a low score. None records the result and passes the response through. Block returns the blocked output message and stops the request. (one of: none, block).

--bedrock-config.grounding-policy.relevance.enabled

bool

Turns this check on or off independently. Configuration is kept while off. (true when set; pass --bedrock-config.grounding-policy.relevance.enabled=false to disable).

--bedrock-config.grounding-policy.relevance.threshold

float

Minimum score from 0.0 to 0.99. The action fires below it. Higher values flag more responses.

--bedrock-config.grounding-policy.relevance.action

string

Action on a low score. None records the result and passes the response through. Block returns the blocked output message and stops the request. (one of: none, block).

--bedrock-config.automated-reasoning-policy.enabled

bool

Turns automated reasoning on or off. Configuration is kept while off. Findings are added to the response trace. Requests are never blocked. (true when set; pass --bedrock-config.automated-reasoning-policy.enabled=false to disable).

--bedrock-config.automated-reasoning-policy.policy-arns

strings

ARNs of one or two published Bedrock Automated Reasoning policies. Each ARN ends in a numeric version such as :1. DRAFT versions are rejected. (repeatable; replaces the full list on update).

--bedrock-config.automated-reasoning-policy.confidence-threshold

float

Confidence required for a definitive finding, from 0.0 to 1.0. Lower-confidence results are reported as ambiguous.

--local-config.bedrock-backend.region

string

AWS region of the companion Bedrock guardrail for delegated families, for example us-east-1. Feature availability varies by region. (required in its group).

--local-config.bedrock-backend.llm-provider-ref

string

Identifier of a Bedrock LLM provider whose AWS credentials the delegated families use.

--local-config.bedrock-backend.standalone.default-chain

bool

Default chain. (selects this credentials mode; takes no value).

--local-config.bedrock-backend.standalone.static-credentials.access-key-id-ref

string

Secret store key that holds the AWS access key ID, in UPPER_SNAKE_CASE (for example, AWS_ACCESS_KEY_ID). The credentials need permission to manage Bedrock guardrails in the configured region. (required in its group).

--local-config.bedrock-backend.standalone.static-credentials.secret-access-key-ref

string

Secret store key that holds the AWS secret access key, in UPPER_SNAKE_CASE (for example, AWS_SECRET_ACCESS_KEY). (required in its group).

--local-config.bedrock-backend.standalone.assume-role.role-arn

string

ARN of the IAM role to assume through STS (arn:aws:iam::<account-id>:role/<role-name>). The trust policy must allow Redpanda to assume the role, and the role must be able to manage Bedrock guardrails in the configured region. (required in its group).

--local-config.bedrock-backend.standalone.assume-role.external-id

string

External ID passed to STS. Required only when the role’s trust policy sets a condition on sts:ExternalId, and must match it exactly.

--local-config.bedrock-backend.standalone.assume-role.session-name

string

Session name recorded in CloudTrail for calls this guardrail makes. Defaults to a Redpanda-supplied name.

--local-config.word-filter-policy.engine

string

Engine for word filters. Local runs in the gateway and keeps text in the cluster. Bedrock runs in the companion guardrail. Unset uses the platform default. (one of: local, bedrock).

--local-config.word-filter-policy.shadow-local

bool

Runs the local engine alongside Bedrock and reports differences without enforcing them. Not yet available. (true when set; pass --local-config.word-filter-policy.shadow-local=false to disable).

--local-config.word-filter-policy.enabled

bool

Turns word filtering on or off. Configuration is kept while off. Matching is exact and case-insensitive, so misspellings and paraphrases don’t match. (true when set; pass --local-config.word-filter-policy.enabled=false to disable).

--local-config.word-filter-policy.custom-words

stringArray

Custom word groups. Every word in a group shares the group’s input and output action. Up to 10,000 words across all groups. (repeatable; protojson object; replaces the full list on update).

--local-config.word-filter-policy.managed-lists

stringArray

Platform-curated word lists, such as the profanity list, with an action per direction. (repeatable; protojson object; replaces the full list on update).

--local-config.pattern-filter-policy.engine

string

Engine for custom patterns. Local runs in the gateway and keeps text in the cluster. Bedrock runs in the companion guardrail. Unset uses the platform default. (one of: local, bedrock).

--local-config.pattern-filter-policy.shadow-local

bool

Runs the local engine alongside Bedrock and reports differences without enforcing them. Not yet available. (true when set; pass --local-config.pattern-filter-policy.shadow-local=false to disable).

--local-config.pattern-filter-policy.enabled

bool

Turns custom-pattern detection on or off. Configuration is kept while off. (true when set; pass --local-config.pattern-filter-policy.enabled=false to disable).

--local-config.pattern-filter-policy.patterns

stringArray

RE2 patterns for identifiers the built-in types don’t cover, such as internal account IDs. Lookahead and lookbehind aren’t supported. (repeatable; name (bare values comma-split) or protojson object; replaces the full list on update).

--local-config.pii-filter-policy.engine

string

Engine for built-in PII entities. Local runs in the gateway and keeps text in the cluster. Bedrock runs in the companion guardrail. Unset uses the platform default. (one of: local, bedrock).

--local-config.pii-filter-policy.shadow-local

bool

Runs the local engine alongside Bedrock and reports differences without enforcing them. Not yet available. (true when set; pass --local-config.pii-filter-policy.shadow-local=false to disable).

--local-config.pii-filter-policy.enabled

bool

Turns sensitive-information detection on or off. Configuration is kept while off. (true when set; pass --local-config.pii-filter-policy.enabled=false to disable).

--local-config.pii-filter-policy.entities

stringArray

Rules for the 31 built-in entity types, such as email address, phone number, credit card number, or US Social Security number. (repeatable; protojson object; replaces the full list on update).

--local-config.prompt-attack-policy.engine

string

Engine for prompt attacks. Local runs in the gateway and keeps text in the cluster. Bedrock runs in the companion guardrail. Unset uses the platform default. (one of: local, bedrock).

--local-config.prompt-attack-policy.shadow-local

bool

Runs the local engine alongside Bedrock and reports differences without enforcing them. Not yet available. (true when set; pass --local-config.prompt-attack-policy.shadow-local=false to disable).

--local-config.prompt-attack-policy.enabled

bool

Turns prompt-attack detection on or off. (true when set; pass --local-config.prompt-attack-policy.enabled=false to disable).

--local-config.prompt-attack-policy.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.prompt-attack-policy.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input message and stops the request. (one of: none, block).

--local-config.prompt-attack-policy.input.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.engine

string

Engine for harm categories. Local runs in the gateway and keeps text in the cluster. Bedrock runs in the companion guardrail. Unset uses the platform default. (one of: local, bedrock).

--local-config.content-filter-policy.shadow-local

bool

Runs the local engine alongside Bedrock and reports differences without enforcing them. Not yet available. (true when set; pass --local-config.content-filter-policy.shadow-local=false to disable).

--local-config.content-filter-policy.enabled

bool

Turns all content categories on or off. Configuration is kept while off. Categories run only while the guardrail is enabled. (true when set; pass --local-config.content-filter-policy.enabled=false to disable).

--local-config.content-filter-policy.hate.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.hate.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.hate.input.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.hate.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.hate.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.hate.output.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.insults.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.insults.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.insults.input.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.insults.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.insults.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.insults.output.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.sexual.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.sexual.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.sexual.input.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.sexual.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.sexual.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.sexual.output.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.violence.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.violence.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.violence.input.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.violence.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.violence.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.violence.output.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.misconduct.input.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.misconduct.input.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.misconduct.input.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.content-filter-policy.misconduct.output.strength

string

Detection sensitivity. Low flags only high-confidence matches. High flags any non-negligible match. None records a score without acting. (one of: none, low, medium, high).

--local-config.content-filter-policy.misconduct.output.action

string

Action on a match. None records the match and passes content through. Block returns the blocked input or output message and stops the request. (one of: none, block).

--local-config.content-filter-policy.misconduct.output.modalities

strings

Content types to inspect. Text only when empty. Image requires engine support. (one of: text, image; repeatable; replaces the full list on update).

--local-config.denied-topics-policy.engine

string

Engine for denied topics. Local runs in the gateway and keeps text in the cluster. Bedrock runs in the companion guardrail. Unset uses the platform default. (one of: local, bedrock).

--local-config.denied-topics-policy.shadow-local

bool

Runs the local engine alongside Bedrock and reports differences without enforcing them. Not yet available. (true when set; pass --local-config.denied-topics-policy.shadow-local=false to disable).

--local-config.denied-topics-policy.enabled

bool

Turns denied topics on or off. Configuration is kept while off. Matching is semantic, so paraphrases and misspellings match. (true when set; pass --local-config.denied-topics-policy.enabled=false to disable).

--local-config.denied-topics-policy.topics

stringArray

Topics denied by meaning, each with a name, definition, and optional examples. 1 to 30 topics. (repeatable; name (bare values comma-split) or protojson object; replaces the full list on update).

--local-config.grounding-policy.engine

string

Engine for grounding. Local runs in the gateway. Bedrock runs in the companion guardrail. Unset uses the platform default. (one of: local, bedrock).

--local-config.grounding-policy.shadow-local

bool

Runs the local engine alongside Bedrock and reports differences without enforcing them. Not yet available. (true when set; pass --local-config.grounding-policy.shadow-local=false to disable).

--local-config.grounding-policy.enabled

bool

Turns contextual grounding on or off. Checks run on output only and require a grounding source and query in the request. (true when set; pass --local-config.grounding-policy.enabled=false to disable).

--local-config.grounding-policy.grounding.enabled

bool

Turns this check on or off independently. (true when set; pass --local-config.grounding-policy.grounding.enabled=false to disable).

--local-config.grounding-policy.grounding.threshold

float

Minimum score from 0.0 to 0.99. The action fires below it.

--local-config.grounding-policy.grounding.action

string

Action on a low score. None records the result. Block returns the blocked output message. (one of: none, block).

--local-config.grounding-policy.relevance.enabled

bool

Turns this check on or off independently. (true when set; pass --local-config.grounding-policy.relevance.enabled=false to disable).

--local-config.grounding-policy.relevance.threshold

float

Minimum score from 0.0 to 0.99. The action fires below it.

--local-config.grounding-policy.relevance.action

string

Action on a low score. None records the result. Block returns the blocked output message. (one of: none, block).

--local-config.automated-reasoning-policy.engine

string

Automated reasoning is available only on Amazon Bedrock, so its engine can’t be set to local. (one of: local, bedrock).

--local-config.automated-reasoning-policy.shadow-local

bool

Shadow evaluation is not available for automated reasoning. (true when set; pass --local-config.automated-reasoning-policy.shadow-local=false to disable).

--local-config.automated-reasoning-policy.enabled

bool

Turns automated reasoning on or off. Findings are added to the response trace. Requests are never blocked. (true when set; pass --local-config.automated-reasoning-policy.enabled=false to disable).

--local-config.automated-reasoning-policy.policy-arns

strings

ARNs of one or two published Bedrock Automated Reasoning policies. Each ARN ends in a numeric version such as :1. DRAFT versions are rejected. (repeatable; replaces the full list on update).

--local-config.automated-reasoning-policy.confidence-threshold

float

Confidence required for a definitive finding, from 0.0 to 1.0. Lower-confidence results are reported as ambiguous.

--tags

stringArray

Tags. (repeatable key=value; replaces the full map on update).

-f, --filename

string

manifest to create from (YAML or JSON; "-" for stdin); flags override file values.

--dry-run

bool

print the request that would be sent (with the computed update mask) and exit without calling the server help for create.

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.