Issue Station
Sign In
Tools hereToolbox

litellm - ✅(Solved) Fix [Feature]: Add experimental_guardrail_input_roles to BedrockGuardrail to filter messages by role before INPUT validation [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
BerriAI/litellm#26392•Fetched 2026-04-24 10:36:33
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Author
orolegaorolega
Participants
orolegaorolega
Timeline (top)
labeled ×3cross-referenced ×1

Fix Action

Fixed

PR fix notes

PR #26393: feat: bedrock guardrail input roles filter

Description (problem / solution / changelog)

Relevant issues

Fixes #26392

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

  • I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
  • My PR passes all unit tests on make test-unit
  • My PR's scope is as isolated as possible, it only solves 1 specific problem
  • I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

  • 50-55 passing tests: main is stable with minor issues.
  • 45-49 passing tests: acceptable but needs attention
  • <= 40 passing tests: unstable; be careful with your merges and assess the risk.

  • Branch creation CI run
    Link:

  • CI run for the last commit
    Link:

  • Merge / cherry-pick CI run
    Links:

Screenshots / Proof of Fix

<!-- Include screenshots, screen recordings, or log output demonstrating that your changes work as expected. For bug fixes: show reproduction before the fix and passing behavior after. For new features: show the feature working end-to-end. For UI changes: include before/after screenshots. -->

Type

🆕 New Feature

Changes

  • litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py — stores experimental_guardrail_input_roles from kwargs; filters messages by role in convert_to_bedrock_format before INPUT validation
  • litellm/proxy/guardrails/guardrail_initializers.py — passes experimental_guardrail_input_roles through from LitellmParams to BedrockGuardrail
  • litellm/types/guardrails.py — declares experimental_guardrail_input_roles: Optional[List[str]] on BaseLitellmParams so it is accepted via YAML config and the /guardrail API
<img width="471" height="129" alt="image" src="https://github.com/user-attachments/assets/32f995a3-70f3-4313-9ed1-968c6b8ca043" />

Changed files

  • litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py (modified, +16/-0)
  • litellm/proxy/guardrails/guardrail_initializers.py (modified, +1/-0)
  • litellm/types/guardrails.py (modified, +9/-0)
  • tests/test_litellm/proxy/guardrails/guardrail_hooks/test_bedrock_guardrails.py (modified, +116/-0)
  • tests/test_litellm/proxy/guardrails/test_guardrail_endpoints.py (modified, +1/-1)
RAW_BUFFERClick to expand / collapse

Check for existing issues

  • I have searched the existing issues and checked that my issue is not a duplicate.

The Feature

Adds an opt-in parameter experimental_guardrail_input_roles to BedrockGuardrail that filters messages by role before they are sent to AWS Bedrock for INPUT validation. When set (e.g. ["user"]), only messages matching the specified roles are included in the guardrail request — system prompts and other roles are excluded. Defaults to None, preserving existing behaviour with no filtering.

Motivation, pitch

When using Bedrock guardrails, all messages in the conversation — including system role messages — are forwarded to AWS Bedrock for INPUT validation. System prompts frequently contain proprietary business logic, confidential instructions, or sensitive context that operators explicitly do not want transmitted to a third-party API endpoint outside their control.

This is a common concern in enterprise deployments where the system prompt is considered IP, or where data residency and minimisation requirements restrict what can be sent to external services. The guardrail's job is to evaluate user-submitted content for policy violations — sending the system prompt alongside it is unnecessary for that purpose and expands the data surface without benefit.

There is currently no built-in mechanism to restrict which message roles are included in the Bedrock guardrail INPUT request. Operators who need this today must subclass BedrockGuardrail and override convert_to_bedrock_format, which is brittle and not a supported extension point.

What part of LiteLLM is this about?

Proxy

LiteLLM is hiring a founding backend engineer, are you interested in joining us and shipping to all our users?

No

Twitter / LinkedIn details

No response

extent analysis

TL;DR

To address the issue of sending sensitive system prompts to AWS Bedrock for INPUT validation, consider adding an opt-in parameter to filter messages by role before sending them to Bedrock.

Guidance

  • Review the experimental_guardrail_input_roles parameter in BedrockGuardrail to understand how it filters messages by role.
  • Evaluate the default behavior of BedrockGuardrail and how it affects your specific use case, considering the need to exclude system prompts and other roles from the guardrail request.
  • Assess the feasibility of subclassing BedrockGuardrail and overriding convert_to_bedrock_format as a potential workaround, despite it being brittle and not a supported extension point.
  • Investigate the requirements for data residency and minimization in your enterprise deployment to ensure the proposed solution aligns with these constraints.

Notes

The provided information lacks specific technical details about the current implementation and the desired outcome, making it challenging to provide a more detailed solution.

Recommendation

Apply workaround: Implement the experimental_guardrail_input_roles parameter to filter out system prompts and other unwanted roles from the guardrail request, as this seems to be the most direct approach to addressing the concern about sending sensitive information to AWS Bedrock.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#permission error#memory optimization#batch processing#GPU compatibility

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

litellm - ✅(Solved) Fix [Feature]: Add experimental_guardrail_input_roles to BedrockGuardrail to filter messages by role before INPUT validation [1 pull requests, 1 participants]