Quick verdict
Guardrails is not one switch. It is six independently billed policies, and the production question is which ones your workload actually needs:
- Every production deployment: content filters (including prompt-attack detection) on inputs, plus word filters (free) for brand and competitor terms.
- Anything touching customer data: sensitive information filters — mask or block PII in both directions. Regex-based patterns are free; probabilistic PII detection is metered.
- RAG and agent answers: contextual grounding checks to flag responses that drift from retrieved sources.
- Regulated, audit-facing answers: Automated Reasoning checks — formal-logic validation against rules you author. Powerful, but it is the only policy that needs real up-front modelling work.
Cipher's first-hand rule: ship in observe mode first. Run every policy in flag-only against production traffic for one to two weeks, review what would have been blocked, then flip to block. Teams that start in block mode spend their first month firefighting false positives instead of tuning.
Last updated: August 2026. Rates below are from the official Bedrock pricing page and move — re-verify before budgeting.
What each policy does (and costs)
Charges accrue per 1,000 text units — one text unit is up to 1,000 characters — and only for the policies you enable. Pricing is the same on Standard and Classic tiers.
| Policy | What it catches | Price (per 1,000 text units) |
|---|---|---|
| Content filters (text) | Hate, insults, sexual, violence, misconduct, prompt attacks | $0.15 |
| Content filters (image) | Same categories in image content | $0.00075 per image |
| Denied topics | Semantic topic classification (e.g. financial advice, self-harm) | $0.15 |
| Sensitive information filters | Probabilistic PII detection — SSN/TFN-style IDs, addresses, DOB | $0.10 |
| Sensitive information (regex) | Your own patterns — member IDs, policy numbers | Free |
| Word filters | Exact-match keyword blocking | Free |
| Contextual grounding checks | Ungrounded or irrelevant RAG answers (units = source + query + response combined) | $0.10 |
| Automated Reasoning checks | Formal-logic validation against authored policy rules | $0.17 per policy |
Two billing behaviours worth knowing before the first invoice: if a guardrail blocks the input, you pay the guardrail evaluation but no model inference. If it blocks the response, you pay guardrail evaluation on both sides plus the inference that generated the rejected answer. Blocked responses are not free.
Contextual grounding vs Automated Reasoning
Both target hallucinations; they are not interchangeable.
Contextual grounding is probabilistic: it scores whether the response is supported by the retrieved source and relevant to the query. Cheap to enable, no authoring work, good default for every RAG surface. Its honest limit: it measures grounding in your sources, so if your corpus is wrong, a grounded answer is still wrong.
Automated Reasoning converts written policy into formal logic and validates responses mathematically — AWS positions it as the first formally verified guardrail, with auditable explanations for each decision. It is the right tool when a compliance team needs to defend answers (loan eligibility wording, benefits rules). Its honest limit: someone has to author and maintain the policy model, and at $0.17 per 1,000 text units per policy it is the most expensive filter on the card. Do not enable it as decoration.
Budget math for a real workload
Take a support assistant doing 100,000 exchanges a month, averaging 2 text units of input and 3 of output. Content filters + denied topics on input, content filters + grounding on output:
- Input: 200k text units × ($0.15 + $0.15) / 1,000 = $60
- Output: 300k text units × $0.15 / 1,000 = $45, plus grounding across source + query + response — call it 900k combined units × $0.10 / 1,000 = $90
Roughly $195/month of guardrail spend before model tokens — real money, but small next to inference, and far cheaper than one leaked-PII incident report. The grounding line dominates because its unit count includes retrieved source text; keep chunk sizes disciplined and the meter follows. Full platform cost shape: AWS Bedrock pricing explained.
The rollout order Cipher uses
- Week 0: word filters + regex PII patterns (both free) — instant wins, zero meter.
- Weeks 1–2: content filters + denied topics in flag-only mode against live traffic. Review the would-have-blocked log with the business owner, tune category strengths.
- Week 3: flip to block. Add probabilistic PII masking on outputs if customer data flows through.
- When RAG lands: contextual grounding, thresholds tuned against a golden set of 30–50 known-good answers.
- Only if audit demands it: Automated Reasoning, scoped to the single policy area a regulator will actually ask about.
One more production note: Guardrails now applies to models outside Bedrock too — the standalone ApplyGuardrail-style APIs let you run the same policies over self-hosted or third-party models (OpenAI, Gemini), at slightly different rates. One policy layer across a multi-provider stack beats three vendor-specific ones.
AU/SG notes
Keep guardrail evaluation in the same Region as inference (Sydney or Singapore) so filtered content never transits elsewhere — check cross-region inference profiles before assuming this. PII masking plus denied topics covers a surprising share of the Australian voluntary AI guardrails and APRA-adjacent expectations; see our Australia AI governance framework guide. Pair with grounded retrieval from Bedrock Knowledge Bases or custom RAG and the policy story is coherent end to end.
Related: Private AI on AWS Bedrock · AgentCore pricing · Applied AI Engineering
FAQ
Do Guardrails work with any Bedrock model? Yes — they sit in front of the model, and via the standalone evaluation APIs they extend to self-hosted and third-party models as well.
Do they add latency? Yes, each enabled policy is an evaluation pass. Most teams accept tens to low hundreds of milliseconds; measure with your own payload sizes rather than trusting anyone's benchmark.
Is Automated Reasoning worth it for a startup? Usually not on day one. Start with content filters, PII masking, and grounding. Add Automated Reasoning when a specific audit or regulator question demands mathematically defensible answers.
Can Guardrails replace human review in regulated workflows? No. They reduce the volume reaching humans and create an audit trail. Australian guidance still expects human accountability for consequential decisions.
Who implements this in production? Cipher Projects designs and ships Bedrock deployments with Guardrails, eval harnesses, and client-owned AWS accounts for Australian and Singapore teams.
Conclusion
Guardrails is cheap insurance when you enable the right policies in the right order: free filters first, metered filters in observe mode, block mode after tuning, and Automated Reasoning only where audit pressure justifies the authoring work. Budget it per filter like any other meter — and never let a blocked-response invoice surprise you.