Why does ChatBedrockConverse only support 1 guardrail? How to use multiple guardrails?

[AlcebiadesFilho]

Question

I need to apply multiple AWS Bedrock Guardrails to my chatbot (PII masking, content filtering, topic blocking, competitor filtering, compliance validation), but ChatBedrockConverse only accepts a single guardrail in the guardrails parameter:

from langchain_aws import ChatBedrockConverse

llm = ChatBedrockConverse(
    model="anthropic.claude-3-5-sonnet-20240620-v1:0",
    guardrails={
        "guardrailIdentifier": "pii-mask",  # ← Can only pass ONE guardrail
        "guardrailVersion": "1",
    }
)

Why this limitation? And how can I apply multiple guardrails to protect against different risks?

[Michael Chin (michaelnchin)]

This is a limitation of the underlying Bedrock Converse API's guardrailConfig: https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use-converse-api.html

Note that a guardrail can be configured with multiple filtering policies - would it be possible to consolidate all of your policies to a single guardrail instead?: https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html

[AlcebiadesFilho]

Thanks for the response! Let me clarify our use case:

Our Scenario

We operate a multi-tenant SaaS platform where:

• 40+ enterprise clients, each with their own isolated instance
• Each client has N departments (varies: some have 5, others 100+)
• Each department requires different guardrail policies (Legal needs PII + compliance, Sales needs competitor filtering, HR needs sensitive data protection, etc.)
• Users belong to M departments (dynamic, changes frequently)
• We need to enforce all relevant department guardrails during streaming

The Problem

We're stuck on how to handle this architecturally:

Option 1: Combined Guardrails

Create a combined guardrail per user based on their department memberships?

Concerns:

• Users in different department combinations = potentially thousands of combined guardrails per client
• When a department updates their policies, how do we propagate to all combined guardrails?
• Should we create/delete these on-demand per session? (latency concerns)

Option 2: Sequential Validation

Apply each department's guardrail sequentially using apply_guardrail API?

Concerns:

• Can only validate INPUT (before streaming) and OUTPUT (after streaming completes)
• During streaming, users see content before OUTPUT validation runs
• For PII/sensitive data, this seems too late

Option 3: Custom Middleware

Use LangGraph middleware to intercept chunks during streaming?

Concerns:

• Not clear if middleware can actually intercept/validate individual chunks during model streaming
• Would this work with ChatBedrockConverse streaming?

Our Question

What's the recommended architecture for multi-tenant scenarios with department-based guardrails?

1. Is creating dynamic combined guardrails the intended approach? If so, any best practices for lifecycle management?
2. Can we somehow apply multiple guardrails during streaming, or is INPUT validation + single native guardrail the only real-time option?
3. Are there any examples of similar multi-tenant implementations?

We're trying to balance security (validate before users see content) with practicality (avoid managing thousands of guardrails).