# bedrock: Add Guardrail configuration support \(\#50084\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/5d3f275cbf2a71b3d6d92535ae63f733b9add30f)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 5d3f275cbf2a71b3d6d92535ae63f733b9add30f

Requested commit: 5d3f275cbf2a71b3d6d92535ae63f733b9add30f

Commit: 5d3f275cbf2a71b3d6d92535ae63f733b9add30f

Tree: 7f36189c9db1eedc604a312156a6d08d8a8cd5de

Author: Gunner Kwon

Committer: GitHub

## Message

````
bedrock: Add Guardrail configuration support (#50084)

## Background: Amazon Bedrock Guardrails

AWS Bedrock Guardrails enables configurable safety and compliance
controls for generative AI applications:
- Evaluates both user inputs and model responses against policies.
:contentReference[oaicite:8]{index=8}
- Can block or filter content based on harmful categories, denied
topics, PII, or hallucination criteria.
:contentReference[oaicite:9]{index=9}
- Guardrails are applied during inference API calls by specifying
`guardrailIdentifier` and `guardrailVersion` in the request.
:contentReference[oaicite:10]{index=10}

Relevant AWS documentation:
- User Guide:
https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html
- How Guardrails Works:
https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-how.html
- API Reference (GuardrailConfiguration):
https://docs.aws.amazon.com/bedrock/latest/APIReference/API_GuardrailConfiguration.html


Some AWS environments enforce IAM policies that require a guardrail to
be specified on every Bedrock API call (via a `StringEquals` condition
on `bedrock:GuardrailIdentifier`). Without this, Zed returns
`AccessDenied` and Bedrock models are completely unusable in those
environments.

This adds two optional settings, `guardrail_identifier` and
`guardrail_version`, to the Bedrock provider config. When set, a
`GuardrailStreamConfiguration` is attached to every `converse_stream`
request. When unset, behaviour is identical to before.

```json
{
  "language_models": {
    "bedrock": {
      "guardrail_identifier": "arn:aws:bedrock:us-east-1:123456789012:guardrail/abc123",
      "guardrail_version": "DRAFT"
    }
  }
}
```

`guardrail_version` defaults to `"DRAFT"` if omitted.

Release Notes:

- agent: Added `guardrail_identifier` and `guardrail_version` settings
for AWS Bedrock, enabling use in environments where IAM policies require
a guardrail on all model requests

---------

Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>
````

## Parents

- [7472c29de0b6bef154803cd88462b048ae03e48b](https://git.cafe/gitcafe/zed/commit/7472c29de0b6bef154803cd88462b048ae03e48b?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/5d3f275cbf2a71b3d6d92535ae63f733b9add30f?format=markdown)