If you have used ChatGPT, you know the simple rhythm. You type a question, it types back an answer. One thing in, one thing out. That is a chatbot. It talks, and that is all it does.
There is a newer kind of AI that does more than talk. People call it an agent. An agent is built on the same kind of AI, but instead of only writing a reply it takes steps to get a job done. It can look something up, draft a plan, use other software, read the result, and keep going. A chatbot tells you how to do something. An agent goes and does it.
Now picture a customer support agent built this way. A person types a question. The system drafts a plan. The person follows up with their account number. The system writes back a final answer. That is four steps. And each step is a fresh chance for something to go wrong. Until recently, most safety tools only watched the very first one.
That gap is what Amazon went after with a new service announced on 16 June 2026. It is called the InvokeGuardrailChecks API. An API is just a way for one piece of software to ask another for help, like a phone line between programs. A guardrail is a safety check that watches what the AI takes in and what it puts out, the way a railing keeps you from stepping off the edge. So the short version is this. This service lets you check an AI agent at each step of its work, not only once at the start.
Why one safety check stopped being enough
Older AI software was simple. A person sent a request, the AI sent a reply, and you could put a single filter in between. One gate, one check.
Agents broke that picture. An agent does not answer once and stop. It plans, reaches for other tools, reads what comes back, and loops around again. Amazon’s announcement describes sessions that can run 10, 20, or more steps before the agent is finished. Every one of those steps is a new chance for trouble. Someone can hide a sneaky instruction in a later message. The AI can repeat back a credit card number it should have hidden. A tool it called can return data that knocks the whole conversation off course.
A single check at the start sees none of that. By the time the dangerous part shows up at step seven, that first gate is long behind it.
Think of an airport. You can put all your security at the front entrance, or you can check at the entrance, again at the gate, and once more before boarding. Agents need the second kind. The risk does not sit politely at the door. It moves through the building.
What the tool actually does
The first thing to understand is that it does not decide for you. It gives a score.
Run a check and you get back a number between 0 and 1. Not a fuzzy word like “risky,” but one of six set values: 0, 0.2, 0.4, 0.6, 0.8, or 1.0. A score of 1.0 means the strongest possible match for whatever you were checking. A score of 0 means the content looks clean. Everything else falls in between.
This is called detect-only mode, and it changes who is holding the wheel. The system tells you how risky something looks. You decide what to do about it. Block it. Let it through. Try the request again. Or quietly save a note to look at later. The line you draw is yours to set.
That choice matters more than it sounds. The blog gives a sharp example. A financial company might decide that anything scoring 0.4 or higher on a harmful-content check gets blocked. A creative writing tool, where edgy language is part of the point, might wait until the score hits 0.8. Same engine. Same scores. Two very different lines in the sand, because two different businesses have two different ideas of “too far.”
The three things it watches
The checks come in three groups.
The first is harmful content. The system looks for things like hate, violence, sexual content, insults, and misconduct, and gives each one a score on that 0-to-1 scale.
The second is attempts to trick the AI, and Amazon made this its own separate check rather than folding it into the first group. These are the tactics people use to manipulate an AI. Some try to talk it out of its own rules. Some smuggle hidden orders inside normal-looking text. Some try to make the AI spill the private instructions it was given. You can ask for these one at a time instead of all at once.
The third is personal data, and this is where the detail gets useful for anyone in a field with strict rules. The tool knows 31 types of personal data. Emails, phone numbers, social security numbers, credit card numbers, and more. When it finds one, it does not just say “personal data is in here.” It hands back the exact spot, a start point and an end point, marking where in the text that piece sits. So you learn that it found a card number, and you learn it starts at character 142 and ends at character 158.
That precision is the difference between “something in this message needs hiding” and “hide exactly these sixteen characters.”
The quiet convenience: nothing to set up first
There is a smaller change here that is easy to skip past but matters for how teams actually work.
The older way made you build a safety setup first. You created a saved profile, gave it a version, stored its name, and pointed back to that name every time you ran a check. When your needs changed, you updated or replaced it. A small thing to keep babysitting.
The new tool is what Amazon calls resourceless. There is nothing to build ahead of time. You list the checks you want inside each request, and the answer comes back labeled to match exactly what you asked for. Ask for a content check and a personal-data check, and the reply has one result for each, lined up neatly. No saved profile sitting in the background, no name to track, no create-and-delete shuffle.
To turn it on, the setup is one line of permission to use the service. The checks can run at the same time, so looking at several tool results at once does not mean waiting for them one by one. And it fits into agent software already in use, with the blog pointing to one such system, Strands Agents, as an example.
Why a CEO or investor should care
Most of this reads like plumbing. It is not, once you think about who carries the blame when something breaks.
If you run AI that touches customer accounts, payment data, or health records, the question regulators and partners will eventually ask is simple. What did you check, and when did you check it? A single check at the front door gives a weak answer. A system that scores every step, names the kind of risk, and points to the exact text where personal data showed up gives a strong one.
There is also a quieter business point in the report-only design. Because the tool tells you the risk rather than acting for you, the very same safety engine can serve a strict, by-the-book product and a loose consumer product without building anything twice. You are not buying one rigid rule. You are buying a measurement, and the rule lives in your own software where it belongs.
Where the limits are
The announcement is honest by what it leaves out, and that is worth naming. The post lists no price. It gives no speed figures, so how much delay each check adds to a live conversation is not stated. That delay is real, because every check is a separate request, and an agent running many checks across many steps is doing real work behind the scenes. Anyone planning to use this should measure that cost against their own traffic before committing.
The scores are also rough on purpose. Six possible values, not a smooth dial. That keeps your line simple to draw, but it means you cannot set it at 0.55. You are choosing among 0, 0.2, 0.4, 0.6, 0.8, and 1.0, and your rule has to fit those steps.
None of that takes away from the core idea. Safety for AI agents had been stuck at the front door while the agents themselves moved deeper into the building. Putting a scored checkpoint at every step, and letting each business set its own line, is the right shape for the problem. The cost and speed questions are the ones to ask next.
Sources: aws.amazon.com