Security, Compliance, and Governance · Topic 8 of 8
Governance for Generative and Agentic AI
Filter prompts and responses with Bedrock Guardrails, enforce them across accounts, secure agents with AgentCore Identity, and add human approval.
- 6 min
- Guardrails check both inputs and outputs;
ApplyGuardrailworks without invoking a Bedrock model. - Enforce guardrails with
bedrock:GuardrailIdentifier, account-level enforcement or organization-level Bedrock policies. - Layered guardrails combine, and the most restrictive control wins.
What it is
Generative AI adds risks that IAM alone does not cover. A model can be tricked by a prompt, return harmful or made-up content, or leak personal data. Agents go further: they call tools and APIs, so they need identities and credentials of their own.
The exam expects three controls. Amazon Bedrock Guardrails filters what goes in and out of a model, and Amazon Bedrock AgentCore Identity controls who an agent is and what it may reach. A human approval step, usually built with AWS Step Functions, holds high-impact actions until a person agrees.
How it works
Amazon Bedrock Guardrails
A guardrail is a set of safeguards evaluated against user inputs and model responses.
| Safeguard | What it does |
|---|---|
| Content filters | Detect hate, insults, sexual, violence and misconduct content, and prompt attacks, with a strength per category |
| Denied topics | Block topics you define, such as investment advice in a banking bot |
| Word filters | Block custom words or phrases, including profanity |
| Sensitive information filters | Block or mask PII such as addresses or dates of birth, plus custom regex patterns |
| Contextual grounding checks | Detect responses not grounded in the source or not relevant to the query, for RAG |
| Automated Reasoning checks | Validate responses against a set of logical rules |
You test the working draft, then create an immutable numbered version for production. A guardrail can be passed with the inference call, or used on its own with the ApplyGuardrail API to check text from any model, including models hosted outside Bedrock.
Enforcing guardrails centrally
Asking every team to remember the guardrail does not scale.
| Scope | Mechanism |
|---|---|
| A role or team | IAM condition key bedrock:GuardrailIdentifier that denies inference calls without the approved guardrail |
| A whole account | Account-level enforcement, which applies a chosen guardrail version to every model invocation in that account |
| Many accounts or OUs | Organization-level enforcement through AWS Organizations Amazon Bedrock policies |
When organization, account and request guardrails all apply, all of them are enforced and the most restrictive control wins. Organization enforcement needs a numbered guardrail version in the management account, shared through a resource-based policy, and Automated Reasoning checks are not supported in enforced guardrails.
Access control for agents with AgentCore Identity
AgentCore Identity manages identities and credentials for AI agents. An agent identity is a workload identity with agent-specific attributes, kept in an agent identity directory, so the agent authenticates as itself instead of impersonating a user.
Inbound, callers reach the agent with AWS Signature Version 4 or with a JWT from an OAuth 2.0 identity provider such as a Cognito user pool or an external IdP. Outbound, the agent reaches tools and third-party services through credential providers for OAuth 2.0 and API keys.
| Outbound pattern | OAuth grant | Use |
|---|---|---|
| Machine to machine | Client credentials (2LO) | The agent calls a backend API as itself |
| On behalf of a user | Authorization code (3LO) | The agent reads a user's calendar or CRM data after the user consents |
Tokens and API keys sit in the token vault, and only the specific agent and user combination that obtained a credential can retrieve it. This removes secrets from agent code and environment variables.
Human oversight with AWS Step Functions
For actions with real consequences, such as refunds or production changes, insert a human approval step. The Step Functions callback pattern does this with the .waitForTaskToken suffix.
The workflow sends a task token to the approver, for example through Amazon SNS email or a ticket in an internal tool. The execution pauses until code calls SendTaskSuccess (approve) or SendTaskFailure (reject) with that token. A timeout or heartbeat on the task ends the wait if nobody answers.
Use a Standard workflow, because Express workflows do not support the callback pattern and Standard executions can run for up to one year. The execution history becomes audit evidence of each decision.
A Choice state can route only risky actions to people, using model confidence, amount or action type. Amazon Bedrock Agents action groups can also require user confirmation before a function runs.
How the exam asks about this
- "Every Bedrock call in all production accounts must block PII in responses, and teams must not be able to opt out." -> Organization-level guardrail enforcement with Amazon Bedrock policies in AWS Organizations.
- "An agent must read each user's third-party calendar without storing their passwords." -> AgentCore Identity with an OAuth 2.0 credential provider (3LO) and the token vault.
- "Refunds above a threshold proposed by an AI agent must wait for a manager's approval." -> Step Functions Standard workflow with a
.waitForTaskTokentask and a Choice state on the amount.
What to remember for the exam
- Guardrails check both inputs and outputs;
ApplyGuardrailworks without invoking a Bedrock model. - Enforce guardrails with
bedrock:GuardrailIdentifier, account-level enforcement or organization-level Bedrock policies. - Layered guardrails combine, and the most restrictive control wins.
- AgentCore Identity gives agents their own workload identity and a token vault for OAuth tokens and API keys.
- 2LO is agent to service; 3LO is on behalf of a consenting user.
- Human approval uses the Step Functions
.waitForTaskTokencallback in a Standard workflow.
Do not use an Express workflow for human approval. Express workflows do not support the callback pattern, so the wait for an approver cannot be built there.
Common mistakes
Relying on the system prompt for safety. Instructions in a prompt can be overridden by prompt injection. Guardrails apply filters outside the model and check the response too.
Giving an agent a user's long-term credentials. Storing passwords or static keys in agent code breaks least privilege and audit. Use OAuth through credential providers and the token vault.
Polling a database for approval. A Lambda loop that checks an approval flag adds cost and complexity. The callback pattern simply pauses the workflow until the token returns.
Check yourself
How can a company force every inference call in an account to use one guardrail without changing application code?
Use account-level guardrail enforcement, or organization-level enforcement with Amazon Bedrock policies for many accounts.
What does the AgentCore Identity token vault protect?
OAuth tokens, API keys and other credentials, which only the agent and user combination that obtained them can retrieve.
Which Step Functions feature pauses a workflow until a person approves?
The callback pattern with the
.waitForTaskTokensuffix, resumed bySendTaskSuccessorSendTaskFailure.
Topic 8 of 8 in Security, Compliance, and Governance
Test yourself on Security, Compliance, and Governance
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.