AWS Bedrock with .NET: Guardrails for Safe AI Applications

dotnet add package AWSSDK.Bedrock
dotnet add package AWSSDK.BedrockRuntime
            

// Alias to keep both namespaces usable side-by-side
using BedrockGuardrailConfiguration =
    Amazon.BedrockRuntime.Model.GuardrailConfiguration;
using BedrockContentFilterType =
    Amazon.Bedrock.GuardrailContentFilterType;
            

var createRequest = new CreateGuardrailRequest
{
    Name        = $"customer-support-guardrail-{DateTime.UtcNow:yyyyMMddHHmmss}",
    Description = "Content filters + topic denial + PII redaction for a customer support chatbot",

    ContentPolicyConfig = new GuardrailContentPolicyConfig
    {
        FiltersConfig = new List<GuardrailContentFilterConfig>
        {
            new() { Type = BedrockContentFilterType.HATE,
                    InputStrength  = GuardrailFilterStrength.HIGH,
                    OutputStrength = GuardrailFilterStrength.HIGH },
            new() { Type = BedrockContentFilterType.SEXUAL,
                    InputStrength  = GuardrailFilterStrength.HIGH,
                    OutputStrength = GuardrailFilterStrength.HIGH },
            new() { Type = BedrockContentFilterType.VIOLENCE,
                    InputStrength  = GuardrailFilterStrength.MEDIUM,
                    OutputStrength = GuardrailFilterStrength.MEDIUM },
            new() { Type = BedrockContentFilterType.INSULTS,
                    InputStrength  = GuardrailFilterStrength.MEDIUM,
                    OutputStrength = GuardrailFilterStrength.MEDIUM },
            new() { Type = BedrockContentFilterType.MISCONDUCT,
                    InputStrength  = GuardrailFilterStrength.HIGH,
                    OutputStrength = GuardrailFilterStrength.HIGH },
            new() { Type = BedrockContentFilterType.PROMPT_ATTACK,
                    InputStrength  = GuardrailFilterStrength.MEDIUM,
                    OutputStrength = GuardrailFilterStrength.NONE },
        }
    },

    BlockedInputMessaging   = "[BLOCKED] Your message was blocked by the content policy.",
    BlockedOutputsMessaging = "[BLOCKED] The response was blocked by the content policy."
};

var createResponse = await _bedrockClient.CreateGuardrailAsync(createRequest);
string guardrailId = createResponse.GuardrailId;
            

TopicPolicyConfig = new GuardrailTopicPolicyConfig
{
    TopicsConfig = new List<GuardrailTopicConfig>
    {
        new()
        {
            Name       = "off-topic-requests",
            Definition = "Requests asking for entertainment, general knowledge, " +
                         "recipes, coding help, jokes, or trivia unrelated to " +
                         "customer support operations.",
            Examples   = new List<string>
            {
                "Tell me a joke",
                "What is the capital of France?",
                "How do I write Python code?",
                "Give me a recipe for pasta",
                "What's the weather today?"
            },
            Type = GuardrailTopicType.DENY
        }
    }
}
            

SensitiveInformationPolicyConfig = new GuardrailSensitiveInformationPolicyConfig
{
    PiiEntitiesConfig =
    [
        new() { Type   = GuardrailPiiEntityType.EMAIL,
                Action = GuardrailSensitiveInformationAction.ANONYMIZE },
        new() { Type   = GuardrailPiiEntityType.PHONE,
                Action = GuardrailSensitiveInformationAction.ANONYMIZE },
        new() { Type   = GuardrailPiiEntityType.NAME,
                Action = GuardrailSensitiveInformationAction.ANONYMIZE },
        new() { Type   = GuardrailPiiEntityType.IP_ADDRESS,
                Action = GuardrailSensitiveInformationAction.ANONYMIZE },
    ]
}
            

var versionResponse = await _bedrockClient.CreateGuardrailVersionAsync(
    new CreateGuardrailVersionRequest
    {
        GuardrailIdentifier = guardrailId,
        Description         = "Initial production version"
    });

string version = versionResponse.Version;
Console.WriteLine($"Guardrail published as version: {version}");
            

var request = new ConverseRequest
{
    ModelId = "openai.gpt-oss-20b-1:0",
    System  = new List<SystemContentBlock>
    {
        new() { Text = "You are a helpful customer support assistant. " +
                       "Help customers with order tracking, billing questions, " +
                       "shipping issues, and technical support. Be professional, " +
                       "empathetic, and courteous. Keep your answers concise." }
    },
    Messages = new List<Message>
    {
        new()
        {
            Role    = "user",
            Content = new List<ContentBlock> { new() { Text = userInput } }
        }
    },
    GuardrailConfig = new BedrockGuardrailConfiguration
    {
        GuardrailIdentifier = guardrailId,
        GuardrailVersion    = version,
        Trace               = GuardrailTrace.Enabled   // see which policies fire
    }
};

var response    = await _runtimeClient.ConverseAsync(request);
bool intervened = response.StopReason == StopReason.Guardrail_intervened;
string output   = response.Output?.Message?.Content
    .FirstOrDefault(c => c.Text != null)?.Text
    ?? "[no text content]";

Console.WriteLine(intervened ? "⚠️  GUARDRAIL INTERVENED" : "✅ PASSED");
Console.WriteLine(output);
            

private static string GetViolatedPolicy(GuardrailTraceAssessment trace)
{
    var violations = new List<string>();

    // Check input assessments
    if (trace.InputAssessment != null)
    {
        foreach (var (_, assessment) in trace.InputAssessment)
        {
            if (assessment.ContentPolicy?.Filters?.Count > 0)
                violations.Add("Content Filter");
            if (assessment.TopicPolicy?.Topics?.Count > 0)
            {
                var topicNames = assessment.TopicPolicy.Topics
                    .Where(t => !string.IsNullOrEmpty(t.Name))
                    .Select(t => t.Name)
                    .Distinct();
                violations.Add($"Topic Policy: {string.Join(", ", topicNames)}");
            }
            if (assessment.SensitiveInformationPolicy?.PiiEntities?.Count > 0)
                violations.Add("PII");
        }
    }

    // Check output assessments
    if (trace.OutputAssessments != null)
    {
        foreach (var (_, assessments) in trace.OutputAssessments)
        {
            foreach (var assessment in assessments)
            {
                if (assessment.ContentPolicy?.Filters?.Count > 0)
                    violations.Add("Content Filter");
                if (assessment.TopicPolicy?.Topics?.Count > 0)
                {
                    var topicNames = assessment.TopicPolicy.Topics
                        .Where(t => !string.IsNullOrEmpty(t.Name))
                        .Select(t => t.Name)
                        .Distinct();
                    violations.Add($"Topic Policy: {string.Join(", ", topicNames)}");
                }
                if (assessment.SensitiveInformationPolicy?.PiiEntities?.Count > 0)
                    violations.Add("PII");
            }
        }
    }

    return violations.Count > 0 ? string.Join(", ", violations.Distinct()) : "Unknown Policy";
}