Amazon Bedrock Guardrails: PII masking, grounding checks and pricing

Amazon Bedrock Guardrails check the text going into a model and the text coming out against policies you set: harmful content, prompt attacks, denied topics, personal data and answers your sources do not support. They cost from $0.10 to $0.17 per 1,000 text units per policy, a text unit being up to 1,000 characters, and a question a guardrail blocks never reaches the model, so it costs nothing in tokens.

A GuardrailGuardrailChecks placed around a model that stop or change what goes in and what comes out, such as a filter on user messages or an approval step before an agent acts. is one of the cheaper safety layers you can add to a Bedrock app. It is also easy to trust too much. Here is what each policy does, where the gaps are, and what it adds to a bill.

The 6 policies

A guardrail is any combination of these. Each runs on the question first, in parallel; if any blocks it, your application gets the blocked message you wrote and the model is never called. If the question passes, the model answers and the answer is checked too.

Personal data: block or mask

The sensitive information filter has 2 modes. Block refuses the whole request or answer when it finds a type you chose. Mask replaces the value with its type, so "email jane@example.com" becomes "email ". Masking suits summaries of support calls, where the gist matters and the details must not be stored.

Know its 2 limits. It is a machine learning detector, so it misses some values and flags some that are not personal data; test it on your own text. And it does not check tool calls: personal data the model writes into a tool's arguments, data your tools return, and your tool definitions all pass untouched. In an AgentAgentA model that uses tools in a loop, deciding each next step from what the last one returned, until the task is done. that can send emails or write files, check those arguments in your own code.

Grounding checks: catching made-up answers

A contextual grounding check takes 3 things: the source passages, the question and the answer. It scores grounding (is every claim in the sources?) and relevance (does it answer the question?), and blocks answers that score under the thresholds you set, anywhere from 0 to 0.99. It suits RAGRAGA way to answer from your own documents. A search finds the passages that match the question, and they are added to the prompt before the model writes. answers and summaries, where you have the sources at hand.

On 20 October 2026 grounding checks gained a Standard tier that copes with conversational and reasoning answers; the Classic tier marks down anything not stated word for word in the source, including reasonable inferences. Existing guardrails stay on Classic until you change them, and the same answer scores differently on each tier, so test your thresholds again when you switch. The limits are 100,000 characters of source, 1,000 of question and 5,000 of answer. For how made-up answersHallucinationWhen a model states something false as if it were true, such as a wrong date, a made-up quote or a source that does not exist. happen in the first place, see our RAG guide.

Standard or Classic tier

Content filters, prompt attacks, denied topics and grounding checks each come in 2 tiers at the same price. Standard detects prompt attacks more reliably, reads many more languages, understands code and allows denied topic definitions of 1,000 characters instead of 200. It runs through cross-Region inference, so your text may be processed in another Region of the same geography. Classic covers English, French and Spanish only. Choose Standard for anything new unless a data rule keeps you in one Region.

A worked month

A support assistant with 20,000 requests a day (600,000 a month). Questions average 1,500 characters (2 text units), answers 1,200 (2 units). Content filters and personal data masking on both:

• Content filters: 4 units × 600,000 = 2.4 million units × $0.15 per 1,000 = $360
• Sensitive information: 2.4 million × $0.10 per 1,000 = $240

$600 a month. Add a grounding check on answers built from 6,000 characters of sources: 6,000 + 1,500 + 1,200 = 8,700 characters, 9 units a request, 5.4 million units, $540 more. Grounding is priced on the sources too, so it costs most where the prompt is longest.

For scale, the same traffic on Claude Sonnet 5.5 costs about $3,900 a month in tokens with caching on (our Bedrock pricing guide works it out). Guardrails add 15% to 30%. Text units are rounded up, so a 1,001-character answer costs twice what a 1,000-character one does.

Try itWhat Bedrock Guardrails add to a month

Policies

·None·Content filters·Denied topics·Sensitive information·Grounding check

Requests a day

20,000

Characters in the question

1,500

Characters in the answer

1,200

Content filters 4 units × $0.15/1K$360

Sensitive information 4 units × $0.10/1K$240

A month: $600Word and regex filters free

Guard anything with ApplyGuardrail

You do not need to call a Bedrock model to use a guardrail. The ApplyGuardrail API checks any text, marked as INPUT or OUTPUT, and returns the action, what was found and the text units charged for each policy:

import boto3

client = boto3.client("bedrock-runtime")
result = client.apply_guardrail(
    guardrailIdentifier="gr-support",
    guardrailVersion="3",
    source="INPUT",
    content=[{"text": {"text": user_question}}],
)
if result["action"] == "GUARDRAIL_INTERVENED":
    reply = result["outputs"][0]["text"]

Use it to guard a model hosted elsewhere, or to check retrieved documents before they go into a prompt. That matters because a guardrail on a knowledge base checks the question and the answer, not the passages retrieved in between.

What to do

1. Start with content filters (prompt attacks included) and the personal data types you actually handle, on the Standard tier.
2. Write a blocked message that helps the user, not "Sorry, I can't help with that."
3. Check tool arguments for personal data in your own code.
4. Add grounding checks to answers built from sources, and test thresholds on real answers before turning on blocking.
5. Treat guardrails as one layer. For an agent that reads the web, limiting what it can fetch closes the larger hole.