Guardrails and securing AI agents: DVA-C03 study notes and practice questions

What to know for the exam

These questions describe an AI feature that leaks data, answers off-topic questions, follows injected instructions, invents facts or takes risky actions. Pick the control that targets that failure.

The guardrail filters

• Content filters detect harmful text or images in prompts and responses across hate, insults, sexual, violence and misconduct categories. You set the strength for each, separately for prompts and responses.
• Denied topics block subjects you define with a name, a plain-language definition and optional sample phrases, such as investment advice in a bank’s bot.
• Word filters block exact words or phrases, and profanity can be blocked with a built-in list.
• Sensitive information filters detect PII such as names, email addresses and card numbers, and custom regex patterns. Each entity type can block the whole message or mask (anonymize) the value, with separate actions for prompts and responses, so you can block card numbers on input and mask email addresses on output. A masked value is replaced with a placeholder naming the entity type, such as {EMAIL}.
• Contextual grounding checks score a response for grounding in a source and for relevance to the query. A response below the threshold is blocked. This is the check for RAG answers that invent facts.

Prompt attacks and input tags

The prompt attack filter detects jailbreaks and prompt injection in user input. It is an input-side check, and it needs you to mark which part of the prompt is user input, so trusted developer instructions are not flagged. With InvokeModel, wrap the user input in guardrail input tags; AWS recommends a random tag suffix per request so a user cannot close the tag early. Without tags, the prompt attack filter does not run. With Converse, mark the untrusted text as guardContent blocks; the unmarked parts of the message are not evaluated. Instructions hidden in documents or tool results are indirect injection, which this filter does not catch, so limit the agent’s permissions and require confirmation for risky actions.

Applying a guardrail

Attach a guardrail by ID and version to an inference call (guardrailConfig in Converse). Production should pin a numbered version, a fixed snapshot, not the editable DRAFT. When the guardrail acts, Converse returns a stop reason of guardrail_intervened and the configured blocked message; enable the trace to get the assessment and reason for audit logs. The bedrock:GuardrailIdentifier IAM condition key can make a specific guardrail mandatory on invoke and Converse calls. Use the standalone ApplyGuardrail API to check text without calling a model, for example to screen messages from another system or the input and output of a model hosted outside Bedrock. Set the source to INPUT for user content and OUTPUT for model responses. Contextual grounding needs the source text and the query passed as marked content, so the check can compare against them.

Securing agents

• AgentCore Identity gets OAuth 2.0 tokens for agent tools and keeps them in a token vault, so tokens are not hard-coded. The user federation (three-legged) flow acts with the end user’s own permissions after consent; the machine-to-machine flow acts as the agent.
• AgentCore Gateway exposes tools to agents through authenticated endpoints, so tool use is authorized before a call is made.
• Session isolation: AgentCore Runtime gives each session its own microVM, and the microVM’s memory is sanitized when the session ends. Use a unique session ID per user or conversation. AgentCore does not map users to sessions, so your backend must track which session belongs to which user.
• Human-in-the-loop: for a sensitive action such as a payment or deletion, have the agent pause and ask a person to approve before it runs.
• Authorization in the tool: the tool’s code (for example the action group’s Lambda function) must check that the user may take the action, such as owning the order, using an identity set by the server, not by the model.

How to choose

Common traps

• Expecting the prompt attack filter to check tool results or responses.
• Using masking where the wording requires the request to be rejected.
• Assuming an unversioned draft guardrail is what production calls use.
• Treating session isolation as user authorization. The app still maps users to sessions.
• Relying on a guardrail alone to stop an agent from taking a risky action.

Try the 2 practice questions ↓