AWS Bedrock Compliance Witnessing

v0.7.8 PREVIEW – Bedrock Guardrails and Strands agent adapters ship with v0.7.8. Available on PyPI and npm at release.

1. The Evidence Gap

Every enterprise Bedrock deployment has the same compliance architecture: IAM policies control who can call the models, CloudTrail logs that they did, and Guardrails filter what goes in and out. This is necessary. It is not sufficient.

Here is what a CloudTrail entry for a Bedrock Guardrails evaluation actually contains:

{
  "eventName": "ApplyGuardrail",
  "userIdentity": {"arn": "arn:aws:iam::123456:role/ai-service"},
  "requestParameters": {
    "guardrailIdentifier": "abc123",
    "source": "INPUT"
  }
  // No content. No decision. No assessment details.
}

The guardrail ran. Something was evaluated. But the audit record does not capture what was evaluated, whether the guardrail intervened, or which policy triggered the decision. It is metadata about the API call, not evidence of the decision itself.

This matters because regulators do not ask "did you have guardrails?" They ask: "Show me the evidence that your guardrails made the right decision on this specific input at this specific time, and prove this evidence has not been altered."

SWT3 closes this gap. Every guardrail evaluation, every agent invocation, every model inference gets a witness anchor: a cryptographic fingerprint of the decision that can be verified independently, years later, without access to the underlying data.

2. Three Layers of Bedrock Witnessing

A production Bedrock deployment has three distinct decision surfaces. Each produces evidence that auditors need. Each has a dedicated SWT3 adapter:

Layer	What Happens	Adapter	Procedure	What Gets Witnessed
Guardrails	Content filtering, topic blocking, PII detection	wrap_bedrock_guardrails	AI-GRD.1	Each guardrail evaluation: what was checked, whether it intervened, which policy triggered
Agents	Multi-step reasoning, tool selection, task execution	wrap_strands	AI-INF.1	Each agent invocation: prompt in, result out, model used, total latency
Inference	Direct model calls via InvokeModel/Converse	wrap_bedrock	AI-INF.1	Each model response: prompt hash, response hash, token usage, latency

3. Guardrails Witnessing (AI-GRD.1)

Bedrock Guardrails evaluate content against policies you define: topic restrictions, content filters, word blocklists, PII detection, contextual grounding. When a guardrail intervenes, it blocks or modifies the content. When it does not, the content passes through.

Both outcomes are evidence. A guardrail that passes content is attesting "this content met all policy requirements at this time." A guardrail that intervenes is attesting "this content violated policy X and was blocked." Both decisions need to be witnessed because both are compliance-relevant.

Python

import boto3
from swt3_ai import Witness
from swt3_ai.adapters.bedrock_guardrails import wrap_bedrock_guardrails

witness = Witness(
    endpoint="https://your-instance.example.com/api/v1/witness",
    api_key="axm_your_key",
    tenant_id="YOUR_TENANT",
)

bedrock = boto3.client("bedrock-runtime", region_name="us-east-1")
witnessed = wrap_bedrock_guardrails(bedrock, witness)

# Every guardrail evaluation is now witnessed
result = witnessed.apply_guardrail(
    guardrailIdentifier="my-content-policy",
    guardrailVersion="1",
    source="INPUT",
    content=[{"text": {"text": "Evaluate this user message"}}],
)

# result is untouched -- your code works exactly as before
if result["action"] == "GUARDRAIL_INTERVENED":
    print("Content blocked by policy")
else:
    print("Content passed all checks")

witness.flush()

TypeScript

import { Witness } from '@tenova/swt3-ai';
import { wrapBedrockGuardrails } from '@tenova/swt3-ai';
import { BedrockRuntimeClient, ApplyGuardrailCommand } from '@aws-sdk/client-bedrock-runtime';

const witness = new Witness({
  endpoint: 'https://your-instance.example.com/api/v1/witness',
  apiKey: 'axm_your_key',
  tenantId: 'YOUR_TENANT',
});

const bedrock = new BedrockRuntimeClient({ region: 'us-east-1' });
const witnessed = wrapBedrockGuardrails(bedrock, witness);

const result = await witnessed.applyGuardrail({
  guardrailIdentifier: 'my-content-policy',
  guardrailVersion: '1',
  source: 'INPUT',
  content: [{ text: { text: 'Evaluate this user message' } }],
});

await witness.flush();

4. Strands Agent Witnessing (AI-INF.1)

Strands agents are autonomous: they receive a prompt, reason about it, select and execute tools, and return a result. The internal loop -- model calls, tool selections, intermediate reasoning -- is managed by the framework. From the outside, you see the input and the output.

That outer boundary is exactly where compliance evidence lives. An auditor does not need to trace every internal reasoning step (that is model interpretability, a different problem). They need to verify: this agent was invoked with this input, it produced this output, using this model, in this timeframe. SWT3 witnesses that boundary.

Python

from strands import Agent
from swt3_ai import Witness
from swt3_ai.adapters.strands import wrap_strands

witness = Witness(
    endpoint="https://your-instance.example.com/api/v1/witness",
    api_key="axm_your_key",
    tenant_id="YOUR_TENANT",
    agent_id="claims-processor",
)

agent = Agent(model="us.anthropic.claude-sonnet-4-20250514")
witnessed = wrap_strands(agent, witness)

# Identical usage -- agent is still callable
result = witnessed("Review this insurance claim and flag anomalies")

witness.flush()

TypeScript

import { Agent } from '@strands-agents/sdk';
import { Witness, wrapStrands } from '@tenova/swt3-ai';

const witness = new Witness({
  endpoint: 'https://your-instance.example.com/api/v1/witness',
  apiKey: 'axm_your_key',
  tenantId: 'YOUR_TENANT',
  agentId: 'claims-processor',
});

const agent = new Agent({ model: 'us.anthropic.claude-sonnet-4-20250514' });
const witnessed = wrapStrands(agent, witness);

const result = await witnessed.invoke('Review this insurance claim and flag anomalies');

await witness.flush();

5. Model Inference Witnessing

For direct model calls (no agent framework), the existing Bedrock adapter witnesses every InvokeModel or Converse call:

import boto3
from swt3_ai import Witness

witness = Witness(
    endpoint="https://your-instance.example.com/api/v1/witness",
    api_key="axm_your_key",
    tenant_id="YOUR_TENANT",
)

bedrock = boto3.client("bedrock-runtime")
witnessed = witness.wrap(bedrock)  # auto-detects Bedrock

response = witnessed.converse(
    modelId="us.anthropic.claude-sonnet-4-20250514",
    messages=[{"role": "user", "content": [{"text": "Summarize this report"}]}],
)

witness.flush()

Every call gets an anchor: model hash, prompt hash, response hash, latency, token usage. The response is untouched. Your application code does not change.

6. Combining All Three Layers

A real production pipeline often uses all three: guardrails filter input, a model generates a response, guardrails filter output. With SWT3, every decision surface is witnessed independently:

import boto3
from strands import Agent
from swt3_ai import Witness
from swt3_ai.adapters.bedrock_guardrails import wrap_bedrock_guardrails

witness = Witness(
    endpoint="https://your-instance.example.com/api/v1/witness",
    api_key="axm_your_key",
    tenant_id="YOUR_TENANT",
    agent_id="underwriting-agent",
    jurisdiction="US",
)

bedrock = boto3.client("bedrock-runtime")

# Layer 1: Witness guardrail evaluations
guarded = wrap_bedrock_guardrails(bedrock, witness)

# Layer 2: Witness agent invocations (agent uses Bedrock internally)
from swt3_ai.adapters.strands import wrap_strands
agent = Agent(model="us.anthropic.claude-sonnet-4-20250514")
witnessed_agent = wrap_strands(agent, witness)

# Pre-inference guardrail check
input_check = guarded.apply_guardrail(
    guardrailIdentifier="input-policy",
    guardrailVersion="1",
    source="INPUT",
    content=[{"text": {"text": user_message}}],
)

if input_check["action"] == "NONE":
    # Input passed -- run the agent
    result = witnessed_agent(user_message)

    # Post-inference guardrail check
    output_check = guarded.apply_guardrail(
        guardrailIdentifier="output-policy",
        guardrailVersion="1",
        source="OUTPUT",
        content=[{"text": {"text": str(result)}}],
    )

# 3 anchors minted: input guardrail + agent invocation + output guardrail
witness.flush()

7. Regulatory Mapping

Every anchor minted on Bedrock maps to specific regulatory requirements. The evidence is not theoretical -- it is the exact artifact that satisfies the obligation.

Regulation	Requirement	CloudTrail	SWT3
EU AI Act Art. 12	Automatic logging of AI system operation	API metadata only	Per-decision fingerprint
EU AI Act Art. 13	Transparency: deployers must understand AI output	No output evidence	Response hash + model ID
EU AI Act Art. 14	Human oversight measures	No guardrail decision log	Guardrail intervention evidence
NIST AI RMF MAP 1.5	Document AI system interfaces and dependencies	Partial (IAM roles)	Agent + model + guardrail chain
NIST AI RMF MN 2.2	Mechanisms to track AI system behavior	API-level only	Decision-level tracking
SOC 2 CC7.2	Monitor system components for anomalies	Infrastructure monitoring	AI decision monitoring
FedRAMP AU-2	Audit events for security-relevant activities	API call audit	Decision-level audit
SR 11-7 / SR 26-2	Model risk management: ongoing monitoring	No model behavior data	Drift detection via hash comparison

8. Quick Start

Install

# Python
pip install swt3-ai

# TypeScript
npm install @tenova/swt3-ai

Choose Your Starting Point

If You Have	Start With	Lines of Code
Bedrock Guardrails in production	wrap_bedrock_guardrails(client, witness)	3
Strands agents in production	wrap_strands(agent, witness)	3
Direct InvokeModel/Converse calls	witness.wrap(bedrock_client)	1

Minimal Example (Guardrails)

import boto3
from swt3_ai import Witness
from swt3_ai.adapters.bedrock_guardrails import wrap_bedrock_guardrails

witness = Witness(
    endpoint="https://your-instance.example.com/api/v1/witness",
    api_key="axm_your_key",
    tenant_id="YOUR_TENANT",
)

bedrock = boto3.client("bedrock-runtime")
witnessed = wrap_bedrock_guardrails(bedrock, witness)

# Your existing code. Unchanged. Every evaluation witnessed.
result = witnessed.apply_guardrail(
    guardrailIdentifier="my-policy",
    guardrailVersion="1",
    source="INPUT",
    content=[{"text": {"text": "user input here"}}],
)

witness.flush()

Three lines added. Zero code changes to your application logic. Every guardrail decision now has a cryptographic witness anchor that survives independently of AWS infrastructure.

9. References

• AWS Bedrock Guardrails Documentation
• Strands Agents SDK Documentation
• Bedrock Model Invocation Logging
• EU AI Act Compliance Crosswalk
• NIST AI RMF Crosswalk
• SR 11-7 / SR 26-2 Model Risk Overlay
• SWT3 SDK Documentation
• swt3-ai on PyPI
• @tenova/swt3-ai on npm