Bedrock ApplyGuardrail API: Pre/Post Filters for Tool I/O in Coding Agents

// ❌ Only Converse guardrail — tool I/O bypasses your intent
const res = await bedrock.send(
 new ConverseCommand({
 modelId,
 guardrailConfig: {
 guardrailIdentifier: process.env.GUARDRAIL_ID!,
 guardrailVersion: "DRAFT",
 trace: "enabled",
 },
 messages,
 toolConfig: { tools },
 })
);
// toolUse args and later toolResult text are not your ApplyGuardrail loop

import {
 BedrockRuntimeClient,
 ApplyGuardrailCommand,
 ConverseCommand,
} from "@aws-sdk/client-bedrock-runtime";

const br = new BedrockRuntimeClient({});
const GUARDRAIL_ID = process.env.GUARDRAIL_ID!;
const GUARDRAIL_VERSION = process.env.GUARDRAIL_VERSION ?? "1";

type GR = {
 action: "NONE" | "GUARDRAIL_INTERVENED";
 outputs?: { text?: string }[];
 assessments?: unknown[];
};

async function applyGuardrail(
 text: string,
 source: "INPUT" | "OUTPUT"
): Promise<{ ok: true; text: string } | { ok: false; reason: string; text?: string }> {
 const out = await br.send(
 new ApplyGuardrailCommand({
 guardrailIdentifier: GUARDRAIL_ID,
 guardrailVersion: GUARDRAIL_VERSION,
 source, // INPUT ≈ prompts/args; OUTPUT ≈ model/tool egress
 content: [{ text: { text } }],
 })
 );
 const action = out.action as GR["action"];
 if (action === "GUARDRAIL_INTERVENED") {
 const anonymized = out.outputs?.[0]?.text;
 // Policy: BLOCK sensitive tool paths; ANONYMIZE PII in logs
 if (!anonymized) {
 return { ok: false, reason: "guardrail_blocked" };
 }
 return { ok: true, text: anonymized };
 }
 return { ok: true, text };
}

export async function runToolWithGuardrails(
 name: string,
 args: unknown,
 execute: (args: unknown) => Promise<string>
): Promise<{ status: "success" | "error"; content: string }> {
 const argsText = JSON.stringify(args);

 // ✅ Pre-filter tool arguments
 const pre = await applyGuardrail(argsText, "INPUT");
 if (!pre.ok) {
 return {
 status: "error",
 content: JSON.stringify({ error: pre.reason, tool: name }),
 };
 }

 let raw: string;
 try {
 raw = await execute(JSON.parse(pre.text));
 } catch (e) {
 return {
 status: "error",
 content: JSON.stringify({ error: "tool_threw", message: String(e) }),
 };
 }

 // ✅ Post-filter tool results before model sees them
 const post = await applyGuardrail(raw, "OUTPUT");
 if (!post.ok) {
 return {
 status: "error",
 content: JSON.stringify({
 error: "tool_result_blocked",
 tool: name,
 hint: "Result contained disallowed content",
 }),
 };
 }
 return { status: "success", content: post.text };
}

// ✅ Map intervention → tool error the model can plan around
function toToolResult(
 toolUseId: string,
 gated: { status: "success" | "error"; content: string }
) {
 return {
 toolResult: {
 toolUseId,
 status: gated.status,
 content: [{ text: gated.content }],
 },
 };
}