@decionis/bedrock-guard

@decionis/bedrock-guard

Hard-block guard for Amazon Bedrock Agent action groups. It gates every agent action on a signed Decionis Decision Dossier before it runs — the real enforcement boundary between the LLM orchestration and the enterprise's data (RDS/S3) is the action group's Lambda, and that is exactly where this wrapper sits.

Built on @decionis/aws-lambda-guard (same shadow-default safety model) and @decionis/sdk. Mirrors the semantics of @decionis/langchain's DecionisGateTool, adapted to the Bedrock action-group contract.

Language choice. Bedrock action-group Lambdas run on the Node.js 20 runtime, so this guard is TypeScript and reuses the existing gate engine with zero duplication. A Python port can later live under sdks/python alongside sdks/python-langchain for Python action-group runtimes.

Usage

import { wrapBedrockActionGroup } from "@decionis/bedrock-guard";
import { resolveGuardConfigFromEnv } from "@decionis/aws-lambda-guard";

const config = resolveGuardConfigFromEnv(); // DECIONIS_BASE_URL / API_KEY / ORG_ID / ...

export const handler = wrapBedrockActionGroup(
  async (event) => {
    // Your real action-group business logic. Only runs when the action is allowed.
    return runAction(event);
  },
  { config, siteBaseUrl: "https://decionis.com" },
);

Behaviour

• Shadow-default. An action's decision_type (default bedrock.<actionGroup>.<action>) runs in SHADOW until promoted via DECIONIS_ENFORCED_DECISION_TYPES.
• Blocked / held → denial response, not an exception. When enforced and the outcome is REJECT (block) or REVIEW/ESCALATE (hold), the inner handler never runs and the agent receives a properly-shaped denial it can surface or re-plan around:
  • function-schema → functionResponse.responseState = "FAILURE" with the reason + dossier id.
  • OpenAPI-schema → httpStatusCode: 403 with an application/json error body.
• Verify URL. Set siteBaseUrl to embed a public dossier verification link in the denial.
• Fail-open by default (configurable) when the decision graph is unreachable.

Customizing the decision

• decisionType: a string or (event) => string to key policy/dossier on your own taxonomy.
• buildDecisionRequest: full control over the decision request (return null to skip gating).
• onDecision: observability hook fired for every decision (shadow included).