Amazon Bedrock Guardrails vs ShieldGemma

Amazon Bedrock Guardrails 96

IAM with SigV4, roles and short-lived credentials, and policies can name a single guardrail ARN (30). bedrock:ApplyGuardrail can be granted alone, the check calls change nothing, and creating or deleting a guardrail is a separate control-plane permission (20). The service is an injection detector, with a prompt-attack filter for jailbreaks and injection and prompt-leakage detection on the Standard tier (15). ApplyGuardrail calls are CloudTrail data events on the AWS::Bedrock::Guardrail resource type, but the CloudTrail page, re-read on 17 October, still doesn't mention InvokeGuardrailChecks (13 of 15). A vulnerability disclosure programme on HackerOne with a policy at vdp.aws.security, public security bulletins, and Amazon Bedrock in SOC scope on AWS's list updated 11 August 2026 (Bedrock Marketplace excluded). The aws.amazon.com security.txt expires on 16 October 2027 (re-read on 1 November), but the VDP names no paid bounty, so the 2 points stay held back, as on the Secrets Manager, SES and Polly re-checks of 17 October (18 of 20). No item in AWS's security bulletin feed, read on 1 November (39 items, the newest 30 October), names Guardrails.

ShieldGemma 53

Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.

Amazon Bedrock Guardrails 92

The SDKs are generated from AWS's published service models, and the API reference gives every field with type, pattern and enum (25). The user guide has an llms.txt, re-read on 6 October with 67 lines naming guardrails, and serves .md pages (10). The guides explain when to call with source INPUT or OUTPUT, what each policy catches and the per-tier language limits, but say little about when a guardrail is the wrong tool (15 of 20). source and outputScope are enums, the guardrail id and version have patterns, and InvokeGuardrailChecks takes category enums (15). Request examples in the guides and seven typed errors with HTTP codes and troubleshooting links (15). Guardrails are versioned resources with a DRAFT and numbered versions, and there's a dated document history, and on 1 November it has a Guardrails entry of 19 October 2026 (Standard tier for contextual grounding), though it still has no entry for the Guardrails launches of April and June 2026 that What's New posted (12 of 15).

ShieldGemma 56

Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a guideline argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.

Amazon Bedrock Guardrails 75

AWS Health Dashboard with per-service, per-region history and RSS feeds (20). AWS's dashboard history file, re-read on 1 November, lists Amazon Bedrock in the Middle East (UAE) me-central-1 and Middle East (Bahrain) me-south-1 multi-service events, open since 1 and 2 March 2026 at disruption status. On 15 September 2026, inside the 90-day window, AWS said it can't restore resources and data hosted only in me-south-1 or in the mec1-az2 zone. No update to either event after 15 September and no new Bedrock event since 4 October (the newest event in the file is the API Gateway us-west-2 one of 30 October, which doesn't list Bedrock). The only Bedrock-specific entry is a model access revocation on 13 June 2026, outside the window, and the eu-south-2 packet-loss event of 4 October lists Bedrock AgentCore but not Bedrock. One major event, read as the S3, Secrets Manager and Polly re-checks read it (10). Quotas published per Region in the AWS General Reference, per the 17 October check, not re-read on 1 November, 100 ApplyGuardrail requests a second in nine main Regions and 25 elsewhere, text units a second per policy and tier, and 1,500 InvokeGuardrailChecks calls a minute (15). The InvokeGuardrailChecks guide, per the 17 October check, says to retry 429 and 503 with exponential backoff and 500 as is (15). The Bedrock SLA, last updated 4 October 2023 (per the 17 October check), promises 99.9 per cent a region but covers "the Amazon Bedrock APIs for models" and doesn't name Guardrails (5 of 10, our call). ApplyGuardrail and InvokeGuardrailChecks carry no preview label (10).

ShieldGemma 46

Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is pip install -U transformers[accelerate] with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.

Amazon Bedrock Guardrails 65

Read by the listing's own shapes in the bedrock and bedrock-runtime service models, as this run's amazon-s3 re-check read models/s3. The bedrock model changed on 20 October 2026, adding a Standard or Classic tier for contextual grounding checks and raising the regex filters a guardrail can hold from 10 to 30. The document history (19 October) and What's New (20 October) announced the Standard tier for contextual grounding, 12 days before 1 November (30, up from 10, cause product). In the 90 days from 3 August we found two dated Guardrails changes, the 20 October one and wider name patterns for Automated Reasoning policy definitions on 30 September, which the 17 October check didn't count. Other bedrock and bedrock-runtime changes in the window (31 July, 24 August, 4 September) touch no guardrail shape, so fewer than three (0). Public document history and What's New, and support through re:Post and AWS Support, but the history still misses the April and June 2026 launches (10 of 15). Current SDKs, boto3 1.43.123 on 30 October 2026 (per its release tag) and the @aws-sdk/client-bedrock-runtime client with 21,122,074 npm downloads in the week to 29 October (15). SDKs ship near-daily and support Python 3.10 and later (10). 30 + 0 + 10 + 15 + 10 = 65.

ShieldGemma 40

Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.

Amazon Bedrock Guardrails 30

No x402, MPP or L402 (0). Per-policy prices per 1,000 text units published without a login, unchanged on 1 November (20). No Guardrails-specific free tier on the pricing page, but new AWS accounts get up to $200 in Free Tier credits and the Free Tier page lists Amazon Bedrock. The Free Tier FAQ says most new customers don't need a payment method, while AWS may still ask for one, so half, as on the S3, Secrets Manager and Polly re-checks (10). A person signs up in a browser and sets up IAM (0).

ShieldGemma 52

Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.

Amazon Bedrock Guardrails 93

outputScope INTERVENTIONS keeps the response to what fired, FULL returns every assessment, and usage says how many text units each policy billed (25). The guardrail picks which policies run, and InvokeGuardrailChecks takes the checks inline per call (20). Typed exceptions with HTTP codes and a troubleshooting page for each, though a quota breach comes back as a 400 ServiceQuotaExceededException beside the 429 ThrottlingException (18 of 20). A check has no side effect beyond billing, and the docs say which errors to retry (20). Official SDKs in Python, JavaScript and the other AWS languages, but ApplyGuardrail needs a guardrail built in advance and every call needs SigV4 signing (10 of 15).

ShieldGemma 72

Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or ollama run shieldgemma, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.