Safety
A real AWS Bedrock Guardrail (native ApplyGuardrail, prompt-injection + PII policies) sits in front of every generated response. The objective is effective safety with minimal disruption — a guardrail that blocks everything is trivially safe and trivially useless. Every rate below is a block rate measured on this project's own evaluation suite, not a guarantee about production traffic in general.
Prompt injection block rate
Both guardrail versions
100%
Block rate on the evaluated attack test cases — unchanged across v1 → v2.
Sensitive-information block rate
Both guardrail versions
100%
Block rate on the evaluated PII-extraction test cases — unchanged across v1 → v2.
Benign false positives — guardrail suite
9 benign near-miss cases
Benign false positives — all non-attack cases
99 of 120 dev cases
What changed
Source: scripts/compare_guardrail_versions.py (Phase 8.2), 120 dev cases
A single-parameter change — attack-detection strength PROMPT_ATTACK from HIGH to MEDIUM, PII policy untouched — cut benign false positives from 55.56% to 11.11% on the guardrail suite, with zero cost to the measured attack-injection or PII-extraction block rate. Adopted.
V2's HOLD decision (see Release Gate) includes a benign-false-positive-rate violation measured at 55.56% — that number is from Guardrail v1, the version active when V2 was tested. V2 was never re-evaluated under Guardrail v2, so it's unknown whether V2 would clear the safety cap under the calibrated guardrail. This is a guardrail-version effect, not evidence that V2's prompt is worse than V3's on this axis.