← Safety

Amazon Bedrock GuardrailsAmazon Bedrock Guardrails

Amazon Web Services

云端Cloud 商业Commercial guardrailsguardrails APIAPI 多后端Multiple backends partial lifecycle: active 核验Checked 2026-11-06

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

未确认的信息Information not confirmed

中国大陆是否有本地运营方提供本服务（官方在册区域表未含大陆区域）
具体计费单元与免费额度（定价页当日未给护栏明细）
护栏评估的输入长度上限
支持的完整语言清单（另有专页，本档未逐条核验）
SOC / ISO 等合规证书清单（未逐条核验，只有共享责任模型表述在册）
是否存在托管式异步护栏任务队列

Whether a local operator offers this service in mainland China (no mainland region in the recorded tier region table)
Exact billing units and any free quota (the pricing page carried no guardrail detail on the verification day)
Input length limits for guardrail evaluation
The complete supported-language list (a dedicated page exists; not verified item by item)
SOC / ISO style certification lists (only the shared-responsibility wording was on record)
Whether any hosted asynchronous guardrail job queue exists

它是挂在推理调用上的策略层，也能脱离模型单独评内容。

官方文档把两种用法分开写：一种是调模型时带上 guardrail ID 与版本，另一种是 ApplyGuardrail——不启动模型调用，直接把内容送进护栏评。

它是挂在推理调用上的策略层，也能脱离模型单独评内容。

官方文档把两种用法分开写：一种是调模型时带上 guardrail ID 与版本，另一种是 ApplyGuardrail——不启动模型调用，直接把内容送进护栏评。

适合与不适合When to use it, when not to

适合模型主要跑在 Bedrock 上的团队：策略与控制台、SDK 是一条线，数据保留模式还能当准入闸门用。不适合需要把护栏代码留在自己环境里的团队（那是本地库那条线），也不适合指望「一套护栏跨多云同行为」的人。按官方支持页，护栏与模型的对应关系要逐模型查 model card，不能按模型类型推断。

中文生态China availability 国产 / 国内可直接用 / 备案状态 · 快照domestic / direct access / CAC filing · snapshot 2026-11-06

出品属地Origin: 国外出品foreign-made　AWS 主体；官方 tier 页的在册区域表为美欧亚中东与 GovCloud，未列中国大陆区域。AWS entity; the recorded region table on the tier page covers US / Europe / Asia Pacific / Middle East and GovCloud, with no mainland-China region listed.
国内使用Direct access: 直连未核验direct unknown　同日实测 docs.aws.amazon.com 返回 200，这只是文档可达；服务侧在中国大陆是否由本地运营方提供未核验到官方来源，不以「文档能打开」推断可用或合规。Same-day probe of docs.aws.amazon.com returned 200, which is documentation reachability only; whether the service is offered in the mainland by a local operator is unverified — doc reachability is not availability.
备案状态CAC filing: 备案未核验filing unknown：官方护栏文档未写中国大陆备案/登记信息；本次未检索监管公示名单，不做推断。The guardrail documentation says nothing about mainland filing/registration; the public registry was not searched.

备案信息以网信办《生成式人工智能服务已备案信息》公示名单为准（按批次滚动更新，本站只抄编号不解读）；「大陆可直连」是本站从大陆网络直连实测的结果，不是厂商承诺。GitHub 类站点当日实测有波动，口径写在依据里。Filing status is quoted from the CAC public registry (updated batch by batch; this site copies the number and does not interpret it). "Direct access" is this site's own reachability measurement from a mainland network, not a vendor promise. GitHub-hosted sites fluctuated on the measurement day — the note says so.

固定坐标系Fixed coordinate system

8 个维度dimensions, 与同分区其他对象逐项可比each comparable item by item against others in the same section.

模型与开放条件Model & openness: 守的是你在 Bedrock 上调的模型。官方支持页在册：护栏作用于 bedrock-runtime 的 InvokeModel / InvokeModelWithResponseStream / Converse / ConverseStream 调用；bedrock-mantle 端点不支持。目录中多数模型可挂，嵌入、重排、语音与个别文本模型（页内列了具体清单）不行，挂了会报 ValidationException。 ApplyGuardrail 可脱离模型单独评内容，因此也能守 Bedrock 之外的应用。
It guards the models you invoke on Bedrock. The support page records that a guardrail applies to InvokeModel / InvokeModelWithResponseStream / Converse / ConverseStream on the bedrock-runtime endpoint, and that the bedrock-mantle endpoint does not support guardrails. Most catalogue models work; embeddings, rerankers, speech and a few text models listed on that page do not, and attaching a guardrail to them fails with ValidationException. ApplyGuardrail evaluates content on its own, so it also works for applications outside Bedrock.
运行位置Where it runs: 托管云：区域 API + Bedrock 控制台。检测在 AWS 侧执行，Standard tier 使用跨区域推理。官方页未在册任何本机/离线形态，护栏策略是云端资源（draft + version）。
Hosted cloud: regional APIs plus the Bedrock console. Detection executes on AWS's side, and the Standard tier uses cross-Region inference. No local or offline form is recorded on the official pages; a guardrail is a cloud resource with a working draft and versions.
本地文件Local files: 不读写你的工作区文件：内容通过 API 或控制台测试窗口提交。官方 data-protection 页提示不要把机密信息写进标签或 Name 等自由文本字段，因为那些可能进计费与诊断日志。
It does not touch your workspace files: content is submitted through the API or the console test window. The data-protection page warns against putting confidential information into tags or free-form Name fields, because those may end up in billing and diagnostic logs.
关机后的任务Tasks after shutdown: 以同步评估为主；跨区域推理与跨区保留策略在册，托管式的长任务队列/关机续跑本次未核验到官方声明，记为未知。
Synchronous evaluation is the main shape; cross-Region inference and cross-Region retention are on record. No hosted long-running job queue or resume-after-shutdown surface was verified, recorded as unknown.
工具与扩展Tools & extensions: 策略面在册：content filters（Hate / Insults / Sexual / Violence / Misconduct / Prompt Attack）、 denied topics、word filters、sensitive-information（PII 阻断或掩码，支持自定义 regex）、 contextual grounding checks、Automated Reasoning checks；还能用标签只评估用户输入的片段（该能力只在 SDK/API 侧）。
Policy surface on record: content filters (Hate / Insults / Sexual / Violence / Misconduct / Prompt Attack), denied topics, word filters, sensitive-information filters (PII blocked or masked, with custom regex), contextual grounding checks and Automated Reasoning checks. Tagging lets only part of the user input be evaluated, and that capability is exposed through the SDK / API rather than the console.
上下文与记忆Context & memory: 按请求评估文本与图像，不做会话记忆。语言面按档位分层：Classic 支持英法西，Standard 语言面更广（tier 页在册）；官方另有「支持语言」专页，本档未逐条核验具体语言清单。
It evaluates text and image per request and keeps no session memory. Language coverage is tier-split: Classic supports English, French and Spanish, Standard covers more languages (tier page on record). A dedicated supported-languages page exists but its full list was not verified item by item.
权限与限制Permissions & limits: 数据保留是显式模式：none / default / aws_review /（legacy）provider_data_share / inherit，按 project → account → model 默认解析。官方在册：模型提供方拿不到客户 prompt 与 completion；被保留的内容最长 30 天且在 AWS 边界内；要求人工复核的模型在 none / default 下直接不可用。 IAM / SCP 可强制组织级 ZDR。合规证书明细本次未逐条核验，记为未知。
Retention is an explicit mode: none / default / aws_review / (legacy) provider_data_share / inherit, resolved as project then account then the model default. Recorded on the official pages: model providers get no access to customer prompts and completions; retained content is held inside the AWS boundary for up to 30 days; models requiring human review are simply unavailable under none or default. IAM and SCPs can enforce organisation-wide zero retention. Compliance certificate details were not verified item by item and are recorded as unknown.
适合什么任务Best for: 适合模型主要就在 Bedrock 上、要把护栏挂进推理调用、又要有零保留与人工复核开关可治理的团队。不适合需要自托管护栏（走本地库那条线）、要跨云统一护栏策略，或依赖中国区可用的场景。
Fits: teams whose models mostly live on Bedrock, who want the guardrail attached to the inference call itself, and who need governance switches for zero retention versus human review. Not a fit: teams needing self-hosted rails (the local-library line), one policy spanning several clouds, or anything depending on a mainland-China region.

头号误解Top misconception

以为设成 aws_review 就等于所有请求都被保留：官方写明各模型按 allowed_modes 独立决定
以为目录里任何模型都能挂护栏：嵌入/重排/语音等被官方列为不支持，请求直接报错
以为护栏必须跟着模型调用跑：ApplyGuardrail 可脱离模型单独评，计费与接入路径不同

证据来源Evidence sources

最近核验记录Latest recorded check 2026-11-06，内容更新日content updated on 2026-11-06。单项复核范围见正文或来源说明，不代表所有字段在同一天重新核验。See the text or source notes for item-specific scope; this does not mean every field was rechecked on that date.

类型Type	名称Name	链接Link
docs	Amazon Bedrock Guardrails · 文档主页（策略清单、ApplyGuardrail、测试窗口，2026-11-06 直抓 200）Amazon Bedrock Guardrails · documentation home (policy list, ApplyGuardrail, test window, direct-fetched 200 on 2026-11-06)	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html
docs	Amazon Bedrock Guardrails · Supported Regions and models（生效端点与不支持模型清单，2026-11-06 直抓 200）Amazon Bedrock Guardrails · Supported Regions and models (endpoints and the unsupported-model list, direct-fetched 200 on 2026-11-06)	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-supported.html
docs	Amazon Bedrock Guardrails · Safeguard tiers（Classic / Standard 差异与在册区域列表，2026-11-06 直抓 200）Amazon Bedrock Guardrails · Safeguard tiers (Classic versus Standard differences and the recorded region list, direct-fetched 200 on 2026-11-06)	https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-tiers.html
docs	Amazon Bedrock Guardrails · Data protection（模型提供方无访问、共享责任、TLS/CloudTrail 建议，2026-11-06 直抓 200）Amazon Bedrock Guardrails · Data protection (provider accounts have no access, shared responsibility, TLS / CloudTrail advice, direct-fetched 200 on 2026-11-06)	https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html
docs	Amazon Bedrock Guardrails · Data retention（保留模式、顺序解析、30 天与人工复核边界，2026-11-06 直抓 200）Amazon Bedrock Guardrails · Data retention (modes, resolution order, 30 days and the human-review boundary, direct-fetched 200 on 2026-11-06)	https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html
changelog	Amazon Bedrock Guardrails · 文档历史（2026-10 起的变更条目，2026-11-06 直抓 200）Amazon Bedrock Guardrails · documentation history (change entries from October 2026, direct-fetched 200 on 2026-11-06)	https://docs.aws.amazon.com/bedrock/latest/userguide/doc-history.html
pricing	Amazon Bedrock · Pricing（计费单元结构；本档不采价格数字，2026-11-06 直抓但页内未给护栏明细）Amazon Bedrock · Pricing (billing structure only; this archive carries no price numbers, direct-fetched 200 on 2026-11-06 but the page gave no guardrail detail)	https://aws.amazon.com/bedrock/pricing/

官方口径与未核到项Official record and unverified items

本站尚未完成实测。本档不含拦截率、延迟或费用数字。

实测建议（三条）：

同一 guardrail 在 Classic 与 Standard 档下对同一批样本的判定差异
把 account 模式设为 none 后，要求人工复核的模型不可用会给业务带来什么
ApplyGuardrail 与随推理调用护栏的延迟与结果一致性

This site has not completed measured runs; nothing here covers block rates, latency or cost.

Suggested measurements (three):

How the same guardrail judges the same sample set under Classic versus Standard
What breaks in a workload when the account mode is set to none and a review-requiring model turns unavailable
Latency and result consistency between ApplyGuardrail and a guardrail attached to the inference call

能力边界Capability boundaries

档位差异是实质的：Standard tier 才支持代码内容里的危害检测、跨区域推理与 prompt leakage 检测， denied topics 的字符上限也从 200 提到 1000（tier 页在册）。Classic 只保英法西。 contextual grounding 的 Standard 档只在区域子集可用，在其他区域请求会直接校验失败。 Automated Reasoning checks 是另一套东西：拿逻辑规则校验模型回答，不等同于内容过滤。

The tier difference is substantive: only the Standard tier covers harm hidden inside code elements, cross-Region inference and prompt-leakage detection, and it raises the denied-topic limit from 200 to 1,000 characters (tier page on record). Classic keeps English, French and Spanish. Standard contextual grounding works in a region subset and fails validation elsewhere. Automated Reasoning checks are a separate thing: they validate model answers against logical rules, which is not the same as content filtering.

变更记录说明Change record

变更记录走官方文档历史页。当日在册最新条目为 2026-10-30 的 Watermarking in Amazon Bedrock （列出会加水印的模型与检测方式），护栏相关的历史条目在同页可回溯；本档据此判 lifecycle = active，但护栏自身的独立发布说明页未单独设立，记为口径缺口。

Change history runs through the official documentation-history page. The newest recorded entry on the verification day is October 30, 2026 - Watermarking in Amazon Bedrock, listing which models add a watermark and how to detect it - and guardrail-related entries trace back through the same table. Lifecycle is therefore recorded as active, but there is no standalone guardrail release-notes page, which this archive notes as a documentation gap.