Exams / SAP-C03 / Study guide / Responsible AI controls (Bedrock Guardrails, AgentCore Identity, human approval)
Responsible AI controls (Bedrock Guardrails, AgentCore Identity, human approval): SAP-C03 study notes and practice questions
What to know about Responsible AI controls (Bedrock Guardrails, AgentCore Identity, human approval) for the SAP-C03 exam, from the Security, Compliance, and Governance domain (25% of the exam guide), then 2 free questions to test it. Part of the SAP-C03 study guide.
These questions describe a chatbot, RAG app or AI agent and a requirement such as “block harmful content,” “never return customer PII,” “agents act only with the user’s permissions” or “a person must approve refunds above a limit.”
Amazon Bedrock Guardrails
Filters both prompts and responses:
Content filters for hate, insults, sexual content, violence, misconduct and prompt attacks (jailbreaks and prompt injection), with adjustable strength.
Denied topics you describe in plain language, and word filters including a profanity list.
Sensitive information filters that block or mask PII, plus your own regex patterns.
Contextual grounding checks that catch answers not supported by retrieved sources, useful for RAG.
Automated Reasoning checks that validate responses against logical rules derived from your policies.
Works with Bedrock models through InvokeModel and Converse, with agents and knowledge bases, and with any text (including other models) through the ApplyGuardrail API.
Enforcement: an organization-level Bedrock policy in AWS Organizations, or account-level enforcement, applies a chosen guardrail to every model invocation, so teams can’t skip it. Request-level guardrails stack on top, and the most restrictive result wins.
Log invocations with model invocation logging for audit.
Access control for agents
Bedrock AgentCore Identity gives each agent a workload identity and manages credentials for it: inbound authentication of callers (IAM SigV4 or OAuth/JWT from your IdP), and outbound access to AWS and third-party services through OAuth 2.0 flows or stored API keys, so agents never hold raw secrets.
Agents can act on behalf of a user with that user’s consent and scopes, rather than with one broad service credential.
Apply least privilege to agent execution roles and tool access; treat tool calls like any other API caller with IAM, resource policies and audit logging.
Human oversight
Put risky steps in a Step Functions workflow and use the .waitForTaskToken callback pattern: the workflow pauses, sends the request to a reviewer (email, ticket or app), and continues only when someone calls SendTaskSuccess or SendTaskFailure. Add a timeout and an escalation path.
Good for refunds, account changes, data deletion, or any agent action above a risk threshold.
How to choose
Scenario wording
Pick
Block harmful or off-topic answers
Guardrails content filters and denied topics
Mask PII in responses
Guardrails sensitive information filters
Reduce hallucinations in RAG
Contextual grounding checks
Same safeguards for every team, can’t be bypassed
Organization-level guardrail enforcement
Filter output of a model hosted outside Bedrock
ApplyGuardrail API
Agent calls SaaS APIs as the signed-in user
AgentCore Identity with OAuth
Manager approves before the agent acts
Step Functions .waitForTaskToken
Common traps
Custom Lambda filters or prompt instructions alone when Guardrails does it managed.
Hard-coded API keys in agent code.
One powerful role shared by all agents and users.
Polling loops for approval instead of a task token callback.
A news publisher is launching an assistant that answers readers' questions from its article archive through an Amazon Bedrock knowledge base. Editors require that the assistant decline medical and financial advice, never reveal personal data such as email addresses or account numbers, and make claims only where they are supported by the retrieved articles.
The assistant is used on the website and in the mobile app, and the same rules must apply to every question without depending on each app's code. Editors also want to change the list of blocked topics without redeploying the apps.
Which solution meets these requirements?
Choose one answer.
AA. Add instructions to the system prompt that tell the model to decline medical and financial questions, never repeat personal data, and answer only from the supplied articles, and store the prompt centrally.
BB. Run every answer through an AWS Lambda function that removes email addresses and account numbers with regular expressions before the answer is shown.
CC. Fine-tune a foundation model in Amazon SageMaker AI with examples of refusals and redacted answers, and have both apps call the fine-tuned model.
DD. Create a Bedrock guardrail with denied topics for medical and financial advice, sensitive information filters and contextual grounding checks, and apply it to the model invocations.
Show the answer and explanation
Answer: D
A. Wrong: Prompt instructions are not enforced, and a user can craft a question that gets around them. Even a centrally stored prompt gives no grounding check and no reliable filtering of personal data.
B. Wrong: The function redacts only the patterns it knows, and it does not decline topics or check that the claims are grounded in the articles. Each app would also need to call the function.
C. Wrong: Fine-tuning adds a training project, and the refusals are learned behavior rather than a policy that can be checked and changed on request. Editors would also need a new model each time the blocked topics change.
D. Right: Correct. The guardrail is applied to the model calls on the back end, so both apps get the same rules without changing their code. Editors can change the denied topics and filters in the guardrail, and grounding checks test the answers against the retrieved articles.
Explanation
A Bedrock Guardrail applied to the model invocations enforces denied topics, sensitive information filters and grounding checks for every app, and editors can change its settings without redeploying. Prompt text, fine-tuning and a redaction function each leave one rule unenforced or tied to app code.
A car maker runs a customer-service agent on Amazon Bedrock that can issue service credits to owners. The agent may issue credits of up to 500 USD on its own, but larger credits need a human approver. The agent calls the dealer systems on behalf of the owner who is signed in, and the owner's access must not extend to other owners' records.
Auditors need a record of every prompt and response, including the model calls the agent makes while planning its tool use.
Which THREE designs meet these requirements? (Choose three.)
Choose three answers.
AA. Route credits above 500 USD through an AWS Step Functions workflow that pauses on a task token, and let the approver's tool return the token to resume the workflow when the approver decides.
BB. Give the agent an IAM role that can read and write every owner's records in the dealer systems, and have the prompt tell the model to act only for the signed-in owner.
CC. Record only the agent's final answer in the application's log group, because the auditors need the replies the owners received and not the planning steps.
DD. Enable model invocation logging for the agent's model calls, with prompts and responses delivered to a protected log group that the audit team can read.
EE. Use Amazon Bedrock AgentCore Identity to give the agent a scoped OAuth token for the signed-in owner, and have each tool call the dealer systems with that token.
FF. Use the CloudTrail entries for the agent's Bedrock API calls as the audit record, because CloudTrail logs every model invocation that the agent makes in the account.
Show the answer and explanation
Answers: A, D, E
A. Right: Correct. A paused Step Functions workflow holds the larger credit until a person approves it, and the approval is recorded in the execution history. The agent cannot issue the credit on its own.
B. Wrong: A prompt is not an access control, and the role would let the agent reach any owner's records. This design breaks the rule that owners see only their own records.
C. Wrong: The planning calls and tool requests are part of what the auditors need, and a log of final answers alone misses them. This option does not provide the full prompt and response record.
D. Right: Correct. Model invocation logging records the inputs and outputs of each model call, which gives the auditors the prompt and response record. Protecting the log group limits who can change it.
E. Right: Correct. Each call carries a token limited to the signed-in owner, so the dealer systems enforce the owner boundary on every request. The agent holds no broad standing credentials.
F. Wrong: CloudTrail records who called which API and when, but not the prompt and response bodies. Model invocation logging is the feature that captures the inputs and outputs the auditors need.
Explanation
A Step Functions task-token workflow holds larger credits for human approval, AgentCore Identity limits each call to the signed-in owner, and model invocation logging keeps the prompt and response record. Broad roles, final-answer-only logs and CloudTrail entries without the prompt content each leave one requirement unmet.
Want more on Responsible AI controls (Bedrock Guardrails, AgentCore Identity, human approval)? The 5 full-length practice sets have 7 more Responsible AI controls (Bedrock Guardrails, AgentCore Identity, human approval) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Responsible AI controls (Bedrock Guardrails, AgentCore Identity, human approval)