Compile
A GovernorAI policy compiles deterministically into a Bedrock guardrail configuration — denied tool patterns and deny rules become denied topics, with a hash over the result.
POST /api/v1/guardrails/compileUSE CASES / AWS BEDROCK
The gateway decides. Your account executes.
Bedrock is GovernorAI's inbound enforcement point. An InvokeAgent call reaches an action group, the action group's Lambda proxy asks the gateway for a verdict, and the proxy — inside your AWS account — executes the tool once the decision comes back. The gateway never makes the outbound model call on this path. It is also the richest provider enforcement point in the product: all six outcomes, and the only provider adapter that inspects and shapes its own response text.
allow · deny · pause · redact · mask · constrain Response shaping with drop-verification Agent discovery across ten Bedrock regions
Unlike Azure and GCP, the gateway does not make the outbound model call here. The proxy inside your account executes the tool once the decision comes back — which is why the response codes are the interesting part.
inbound200 · 403 · 20210 regionsyour account executes
SEAM SHAPE · provider_bedrock
Every other provider enforcement point sits in front of the model. This one sits inside your account.
On the Azure and GCP adapters the gateway is the thing that calls the provider. On Bedrock it is not. Invocations arrive from inside AWS and the Lambda proxy performs the tool execution after the verdict returns — which is why this enforcement point can carry outcomes the outbound adapters cannot.
Your AWS account
Bedrock agent
InvokeAgent The agent you already run, unchanged. Action group
ActionGroupExecutor Executor points at the governor Lambda. Lambda proxy
governor-bedrock-proxy Asks first. Executes the tool second. GovernorAI
Gateway
POST /api/v1/gateway/execute Policy, data controls, approvals, evidence. Back in your account
Verdict applied
200 · 403 · 202 Allow executes, deny returns 403, pause returns 202 pending approval. Where the tool actually runs: in your Lambda, in your account, on your network. GovernorAI returns a decision and — where the policy shaped the arguments — the arguments to use. A shaped-argument payload that cannot be parsed is treated as a denial by the proxy rather than a silent fall-back to the originals.
Stated precisely Bedrock and the central gateway path are the two enforcement points where a response body is inspected, not just a request.
The gateway-side Bedrock adapter inspects and shapes its own Bedrock response text. When the resolved outcome is redact or mask, it localizes the sensitive spans, replaces them, then re-scans the shaped text and proves the original content can no longer be detected. If that proof fails — or the outcome resolves to deny or pause on the response — the adapter returns a typed shaping error and the gateway fails closed. The unshaped response is never forwarded.
Honesty note
Response shaping covers content a detector can localize, such as secrets and regulated identifiers; content that cannot be localized fails closed to a deny rather than being partially redacted. Field-level constraining is request-side only and is not applied to responses. Streaming, SSE and binary Bedrock responses are not shaped yet. These limits are declared in the enforcement point capability registry the product ships as a read-only API, not just in this page.
DECLARED CAPABILITY
Six outcomes, and a registry that refuses to let us claim a seventh.
Every enforcement point in GovernorAI declares which interaction kinds it can inspect and which outcomes it can truthfully execute. Choosing a richer outcome than an enforcement point supports fails closed to a deny. The Bedrock enforcement point declares tool calls, prompts and responses — and all six outcomes.
allowThe proxy executes the tool with the arguments it was given.denyThe proxy returns a 403 carrying the reason and the rule that decided.pauseDelivered as a pending-approval response — the Lambda proxy returns a 202 with the approval id and URL.redactRequest arguments, and this enforcement point's own response text, with a re-scan proof.maskSame path as redact: shape, then verify the original value is gone.constrainNarrow an argument before dispatch. Request side only. Verify or deny Shaped arguments are checked against the exact payload sent to the proxy.
A redaction, mask or constraint is not applied hopefully. The shaped arguments are re-verified against the payload that actually goes to the Lambda proxy, and a shaping that cannot be applied cleanly denies rather than sending a half-shaped or original request. The same re-scan guarantee covers the response text.
DISCOVERY
Find the Bedrock agents, in every region somebody used.
Agent sprawl in Bedrock is regional sprawl. The AWS connector lists agents per region, reads each agent's action groups, infers the policy namespace from them, and records whether the action group's executor already points at a governor proxy — so an inventory tells you not just what exists but what is already governed.
us-east-1US East (N. Virginia)us-west-2US West (Oregon)eu-west-1Europe (Ireland)eu-central-1Europe (Frankfurt)ap-northeast-1Asia Pacific (Tokyo)ap-southeast-1Asia Pacific (Singapore)ap-southeast-2Asia Pacific (Sydney)ap-south-1Asia Pacific (Mumbai)ca-central-1Canada (Central)sa-east-1South America (São Paulo)scan_all_regions: true Sweep the catalog Scan every Bedrock region in the connector's catalog, up to five concurrently. Results are de-duplicated by agent and region.
regions: [ … ] Scan a named set Some organisations know exactly which regions are sanctioned. Name them and only those are queried.
(default) The connection's own region With neither option set, only the connection's primary region is scanned. Region strategy is explicit, never implied.
Enrolment, and the way back out Enabling governance repoints an action group's Lambda executor. Disabling restores the ARN it had before.
The original executor ARN is recorded when governance is enabled, and disabling puts it back — so enrolment is reversible per action group rather than a one-way rewrite of an agent you already run in production. Governance writes are made with a region-correct client for the agent's own region.
Honesty note
Multi-region discovery tolerates partial failure: if a region cannot be reached, agents from the other regions are still returned and the failure is logged. That means a discovery result is an inventory of what was reachable at that moment, not a proof that nothing else exists. Read the run's region count alongside its findings.
BEDROCK GUARDRAILS
Complement the provider's guardrails. Do not replace them.
Bedrock Guardrails are a provider-native control that many AWS teams already operate. GovernorAI's position is to work with them: compile a policy into a guardrail configuration, sync it, and then keep watching whether the live guardrail still matches what was approved. Provider-native content controls and action-enforcement point governance answer different questions, and running both is the point.
Sync
Push the compiled configuration to the provider and record the identifier it comes back with, alongside the hash that produced it.
POST /api/v1/guardrails/{id}/syncDiff
Compare what a policy compiles to now against what was synced, before anything is pushed again.
GET /api/v1/guardrails/{id}/diffDrift-check
Read the live guardrail back from the provider, normalize it, hash it, and compare. Somebody editing it in the console is a finding.
POST /api/v1/guardrails/{id}/drift-checkPatrol
A leased, shardable worker that runs the drift check on a schedule, with auto-heal available in a dry-run mode before it is ever allowed to apply.
drift patrol · dry_run | apply What coexistence buys The guardrail says what content is acceptable. The enforcement point says whether this agent may take this action, with these arguments, right now.
Neither answer substitutes for the other. Bedrock Guardrails apply the provider's content policy on the model call; GovernorAI decides the tool invocation at the action boundary, requires approval where the policy demands one, and leaves a hash-chained record of the decision. Where a customer already runs guardrails, GovernorAI's contribution is the action decision, the drift evidence and the audit trail.
Honesty note
Not every field of a GovernorAI policy has an equivalent in a Bedrock guardrail. The compiler reports the unmapped fields in its result rather than dropping them silently, and the mapped-versus-total rule counts are returned with every compile — read them before treating a synced guardrail as equivalent to the policy. Separately, binding a created guardrail onto the model invocation itself is a prototype behind a default-off deployment flag: with the flag unset, nothing in that path executes and the invocation is unchanged. Do not read this section as a claim that provider-native inline enforcement is switched on by default.