feat(models): add guardrails configuration and redaction support to Bedrock provider by Unshure · Pull Request #573 · strands-agents/sdk-typescript

Unshure · 2026-02-25T20:10:59Z

Summary

This PR implements proper handling of modelRedactContentEvent in the Agent SDK, enabling guardrail-based content redaction for both user input and assistant output.

Why This Change Is Needed

When Bedrock Guardrails detect content that should be blocked (either inappropriate user input or harmful assistant output), they emit modelRedactContentEvent events with redaction messages. The SDK needs to:

Capture these events during streaming
Replace blocked content with the redaction messages
Maintain consistency in the message history

Public API Changes

`StreamAggregatedResult` Interface (model.ts)

The result returned by streamAggregated now includes an optional redactionMessage:

interface StreamAggregatedResult {
  message: Message
  stopReason: StopReason
  metadata?: ModelMetadataEvent
  redactionMessage?: string  // For user input redaction
}

`ModelStopData` Interface (events.ts)

The AfterModelCallEvent now includes redaction info:

interface ModelStopData {
  readonly message: Message
  readonly stopReason: StopReason
  readonly redactionMessage?: string  // For user input redaction
}

Architecture

Separation of Concerns

Model Layer (streamAggregated):
- Handles modelRedactContentEvent events
- Directly redacts assistant output by updating the message content
- Returns redactionMessage for agent to handle user input redaction
Agent Layer (_stream):
- Receives redactionMessage from model via invokeModel
- Handles user message redaction using _redactLastMessage helper
- Exposes redactionMessage via AfterModelCallEvent.stopData

Implementation Details

_redactLastMessage: Redacts the last message in the conversation history (preserves role)
Assistant output redaction is handled directly by the model
User input redaction info is passed to agent via redactionMessage

Testing

Tests verify redactionMessage is returned correctly for user input redaction
Tests verify assistant message is redacted directly by model
Tests verify model does NOT modify user messages (agent handles this)

Resolves #564

…edrock provider - Add GuardrailConfig interface with guardrailIdentifier, guardrailVersion, trace, streamProcessingMode, and redaction options - Add guardrailConfig to BedrockModelConfig for Bedrock model configuration - Update _formatRequest to include guardrailConfig in Bedrock API requests - Add ModelRedactContentEvent and ModelRedactContentEventData to streaming.ts - Add _hasBlockedGuardrail method for recursive detection of blocked policies - Add _generateRedactionEvents method for creating redaction events based on config - Update metadata event handling to emit redaction events when guardrails block content - Support both streaming and non-streaming modes - Add comprehensive tests for guardrail configuration, request formatting, blocked detection, and redaction events Resolves #564

github-actions · 2026-02-25T20:14:01Z

Assessment: Request Changes

This PR adds a well-structured guardrails configuration API for Bedrock with good test coverage and documentation. The implementation follows existing patterns and handles both streaming and non-streaming modes correctly.

Review Summary

Missing Exports: The new public types (ModelRedactContentEvent, ModelRedactContentEventData, GuardrailConfig) need to be exported from src/index.ts for customers to properly type-check redaction events and configure guardrails.
API Design: The API follows a clean pattern with sensible defaults (redactInput: true, redactOutput: false). The PR description includes good documentation of use cases and API signatures.

Nice work on the comprehensive test coverage! 🎉

Unshure · 2026-02-25T20:18:03Z

/strands how does this pull request update the agent.messages array? If a user message, or assistant message, is redacted, the message in the messages array should be updated as well with the new content. This can likely be done in the model.ts file, where if a redact event is encountered, it can overwrite the return value from the model.

- Update _convert_to_class_event to handle modelRedactContentEvent - Add redaction handling in streamAggregated to modify messages array - When redactUserContentMessage is present, redact the last user message - When redactAssistantContentMessage is present, replace assistant content blocks - Add comprehensive tests for message redaction in model.test.ts This completes the guardrails Phase 1 implementation by ensuring that when guardrails block content, the messages array is updated with the redacted content so consumers have access to the sanitized messages.

github-actions · 2026-02-25T20:26:33Z

I've implemented the message redaction support in streamAggregated as requested.

Changes Made

`src/models/model.ts`

Added import for ModelRedactContentEvent
Updated _convert_to_class_event to handle the new event type
Added redaction handling in streamAggregated:
- User redaction: When redactUserContentMessage is present, finds and replaces the last user message in the messages array with a new Message containing the redaction text
- Assistant redaction: When redactAssistantContentMessage is present, clears contentBlocks, adds the redaction message, and recreates stoppedMessage with the redacted content

`src/models/tests/model.test.ts`

Added 4 new tests:

Redacts last user message when redactUserContentMessage is present
Redacts assistant content when redactAssistantContentMessage is present
Redacts both user and assistant content when both are present
Finds and redacts only the last user message in multi-turn conversation

All 1033 tests pass.

Unshure · 2026-02-26T16:48:22Z

/strands Im liking this better, but can you update the AggregatedStreamResult to include the redact content, and update the agent class to overwrite the latest message with this redacted content if its present?

- Model now only returns redactContent info without modifying messages - Agent handles both user and assistant message redaction - Simplifies model layer by keeping all message manipulation in agent

Unshure · 2026-02-26T17:18:38Z

src/agent/agent.ts

-      const { message, stopReason } = yield* this._streamFromModel(this.messages, streamOptions)
+      const { message, stopReason, redactContent } = yield* this._streamFromModel(this.messages, streamOptions)

      const afterModelCallEvent = new AfterModelCallEvent({ agent: this, stopData: { message, stopReason } })


Can you add redactContent to AfterModelCallEvent?

Done - added redactionMessage to ModelStopData interface and updated AfterModelCallEvent to include it in stopData.

Unshure · 2026-02-26T17:20:00Z

src/agent/agent.ts


    // result.done is true, result.value contains the return value
-    return result.value
+    return {


nit: Can this still just be result.value?

Done - simplified to return result.value.

Unshure · 2026-02-26T17:20:39Z

src/agent/agent.ts

+  /**
+   * Redacts the last user message in the conversation history.
+   * Called when guardrails block user input and redaction is enabled.
+   *
+   * @param redactMessage - The redaction message to replace the user content with
+   */
+  private _redactLastUserMessage(redactMessage: string): void {
+    // Find and redact the last user message
+    for (let i = this.messages.length - 1; i >= 0; i--) {
+      const message = this.messages[i]
+      if (message && message.role === 'user') {
+        this.messages[i] = new Message({
+          role: 'user',
+          content: [new TextBlock(redactMessage)],
+        })
+        break
+      }
+    }
+  }


Can you update this so that it just redacts the last message, not the last user message?

Done - renamed to _redactLastMessage and simplified to redact the last message regardless of role.

Unshure · 2026-02-26T17:22:55Z

src/models/model.ts

+    redactUserContentMessage?: string
+
+    /**
+     * Message to replace assistant output with when output was blocked by guardrails.
+     */
+    redactAssistantContentMessage?: string


This can just be redactionMessage. We will only ever return this value if the redactUserContentMessage is set. If redactAssistantContentMessage event is returned from the underlying model, then we just update the message of the StreamAggregatedResult so there is no need to redact.

Done - simplified to just redactionMessage. Assistant redaction is now handled directly in the model by updating the message content.

Unshure · 2026-02-26T20:55:50Z

/strands

- Add redactionMessage to ModelStopData and AfterModelCallEvent - Simplify _streamFromModel to return result.value directly - Rename _redactLastUserMessage to _redactLastMessage (redacts any last message) - Simplify StreamAggregatedResult to use single redactionMessage field - Model now handles assistant redaction directly, returns redactionMessage for user redaction

Unshure temporarily deployed to auto-approve February 25, 2026 20:11 — with GitHub Actions Inactive

github-actions bot added the strands-running <strands-managed> Whether or not an agent is currently running label Feb 25, 2026

github-actions bot removed the strands-running <strands-managed> Whether or not an agent is currently running label Feb 25, 2026

github-actions bot added the strands-running <strands-managed> Whether or not an agent is currently running label Feb 25, 2026

github-actions bot removed the strands-running <strands-managed> Whether or not an agent is currently running label Feb 25, 2026

github-actions bot added the strands-running <strands-managed> Whether or not an agent is currently running label Feb 26, 2026

feat(agent): update agent to handle guardrail redaction from model

d52b28b

github-actions bot added strands-running <strands-managed> Whether or not an agent is currently running and removed strands-running <strands-managed> Whether or not an agent is currently running labels Feb 26, 2026

refactor(agent): move all message redaction to agent layer

d7c1f43

- Model now only returns redactContent info without modifying messages - Agent handles both user and assistant message redaction - Simplifies model layer by keeping all message manipulation in agent

github-actions bot removed the strands-running <strands-managed> Whether or not an agent is currently running label Feb 26, 2026

Unshure commented Feb 26, 2026

View reviewed changes

Unshure marked this pull request as draft February 26, 2026 20:55

github-actions bot added the strands-running <strands-managed> Whether or not an agent is currently running label Feb 26, 2026

github-actions bot removed the strands-running <strands-managed> Whether or not an agent is currently running label Feb 26, 2026

Conversation

Unshure commented Feb 25, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why This Change Is Needed

Public API Changes

StreamAggregatedResult Interface (model.ts)

ModelStopData Interface (events.ts)

Architecture

Separation of Concerns

Implementation Details

Testing

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

Unshure commented Feb 25, 2026

Uh oh!

github-actions bot commented Feb 25, 2026

Changes Made

src/models/model.ts

src/models/__tests__/model.test.ts

Uh oh!

Unshure commented Feb 26, 2026

Uh oh!

Unshure Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Unshure Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Unshure Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Unshure Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Unshure commented Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Unshure commented Feb 25, 2026 •

edited by github-actions bot

Loading

`StreamAggregatedResult` Interface (model.ts)

`ModelStopData` Interface (events.ts)

`src/models/model.ts`

`src/models/tests/model.test.ts`