Visual overview
IAM constrains authority, Bedrock applies supported model-interaction controls, and CloudTrail preserves evidence of supported AWS API activity.
Technical reference
Security controls must be mapped to distinct failure modes. The model's behavior is probabilistic; authority and validation should be deterministic.
Attempts to override system intent through content supplied directly to the application.
Treat external documents and tool responses as untrusted data even when they came from an approved integration.
Place supported safety checks at the stage where undesirable content can enter or leave the workflow.
Generated tool calls cannot exceed the permissions and validated operations granted by deterministic infrastructure.
Require explicit approval for high-impact operations rather than asking the model to self-authorize.
For every attack class, define which guardrail, validator, authorization rule, or workflow gate must stop it.
Service limits and capabilities can change. Values shown here reflect the current AWS documentation; use the linked official sources below as the source of truth.
Treat every natural-language channel as untrusted input
Prompt injection occurs when attacker-controlled text attempts to override or redirect the application's intended instructions. The malicious instruction can arrive directly from the user or indirectly inside retrieved documents, web content, tool output, emails, or other data the model reads. Jailbreaks target safety boundaries, while prompt leakage tries to recover hidden system instructions or sensitive context. These are related failure modes but not identical, so a threat model should name which channels and assets are being protected.
A system prompt is not an authorization boundary. If the model can call a tool that deletes data, telling it 'never delete data unless authorized' is weaker than giving the execution role no delete permission until a deterministic approval grants it. Assume the model can be manipulated and design the surrounding system so a manipulated model still has constrained authority.
Guardrails is one layer in a defense-in-depth design
Amazon Bedrock Guardrails can evaluate supported input and output for content policies, denied topics, sensitive information, prompt attacks, contextual grounding, and Automated Reasoning checks according to the configured feature. AWS also exposes APIs that can apply guardrail checks independently of a model invocation, which lets an application screen user input before retrieval, inspect tool content, or validate generated output at a deliberate point in the workflow.
Different checks have different semantics. Contextual grounding requires a grounding source, a query, and content to evaluate and produces grounding/relevance judgments for supported use cases. Automated Reasoning checks validate claims against a formal policy but AWS explicitly notes that they do not provide prompt-injection protection. Prompt-attack/content filters and formal reasoning are complementary controls, not substitutes.
Agentic AI expands the attack surface through tools
An agent can turn a generated token into an API call, so threat modeling must include tool selection, arguments, credentials, target resources, side effects, and returned content. Use narrow tool schemas, server-side validation, per-tool roles, scoped credentials, allowlisted operations, idempotency, rate limits, and human approval for high-impact actions. Never pass a user's broad AWS credentials to a model-controlled tool runner simply because it is convenient.
Tool output is also untrusted. A retrieved web page or ticket body can contain instructions intended for the model rather than facts for the user. Keep data and instructions conceptually separated, label provenance, restrict which content can affect control flow, and validate structured results before another tool consumes them. A security review should follow the full agent loop rather than inspect only the first prompt.
Adversarial testing validates the complete system
Build tests for direct injection, indirect injection in retrieved sources, prompt leakage, role impersonation, encoded/obfuscated instructions, malicious tool output, unsafe structured arguments, excessive retries, and attempts to escape tenant boundaries. Evaluate whether the correct deterministic control stopped the action, not only whether the model produced a polite refusal.
Retain redacted evidence about safety interventions and unexpected tool attempts so patterns can be monitored without turning logs into a sensitive-data warehouse. Update the threat model when models, tools, knowledge sources, Guardrails policy, or agent permissions change. Security testing is a release gate and an operational feedback loop.
Key takeaways
- 01
Prompt injection can be direct or embedded in external context; every natural-language source read by the model is potentially untrusted.
- 02
Guardrails adds model-interaction safeguards but does not replace IAM, application authorization, validation, or least privilege.
- 03
Agent tools turn language-model errors into potential side effects, so tool permissions and arguments must be constrained deterministically.
- 04
Contextual grounding and Automated Reasoning solve different validation problems and do not replace prompt-attack protection.
- 05
Adversarial tests should prove that the surrounding controls prevent unsafe actions even when the model is manipulated.
Official AWS sources
Use these primary AWS resources for the source material behind this article and for deeper reference.