AgentGate vs Amazon Bedrock Guardrails

AgentGate

An agent or its host can send each tool call to one REST endpoint, or wrap an MCP server, and get allow, deny or ask from a local classifier and a YAML policy, with an audit log and approval queue. The project is three days old, auth is off by default, and no detection accuracy is published.

Amazon Bedrock Guardrails

ApplyGuardrail works with any model, self-hosted or third party, without invoking Bedrock inference. Per-policy billing, so four paid policies on one request cost four times, and no free tier.

AgentGate

1. Create a session with the user's real goal first. The goal-alignment head scores every later call against it
2. Pass earlier tool results in history_override with untrusted: true for web or email content, or the injection head sees only the action
3. On ask, stop and tell the user the decision_id. Polling /v1/decisions/:id needs the dashboard key
4. Treat allow_with_checkpoint as allow and keep the checkpoint_id for an undo
5. Expect HTTP 404 with not_found for an unknown session and 401 when the owner has set an agent key

Amazon Bedrock Guardrails

1. Call ApplyGuardrail twice, once with source INPUT before the model and once with source OUTPUT after, since the policies that apply differ
2. Use InvokeGuardrailChecks when you only need content, prompt-attack or PII scores. It needs no guardrail id and runs in detect-only mode
3. Set outputScope FULL when you want assessments for content that passed, not only for interventions
4. Budget in text units of 1,000 characters per policy. A 5,000-character tool result is five units on every paid policy
5. Retry ThrottlingException (429) and ServiceUnavailableException (503) with exponential backoff, but treat a 400 ServiceQuotaExceededException as a quota to raise