@aws/nx-plugin 1.0.15 → 1.1.0

package/src/ts/agent/guardrails/__snapshots__/generator.spec.ts.snap

@@ -0,0 +1,1625 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with cdk > agent.ts 1`] = `
+"import { getGuardrailedModel } from './guardrail.js';
+import { Agent, tool } from '@strands-agents/sdk';
+import {
+  ModelErrorLoggingPlugin,
+  ToolErrorLoggingPlugin,
+} from '@proj/agent-connection';
+import { getSessionManager } from './session.js';
+import { z } from 'zod';
+
+const multiply = tool({
+  name: 'Multiply',
+  description: 'Multiply two numbers',
+  inputSchema: z.object({
+    a: z.number(),
+    b: z.number(),
+  }),
+  callback: ({ a, b }) => a * b,
+});
+
+export const getAgent = async () => {
+  const agent = new Agent({
+    model: getGuardrailedModel(),
+    systemPrompt: \`You are a mathematical wizard.
+  Use your tools for mathematical tasks.
+  Refer to tools as your 'spellbook'.\`,
+    tools: [multiply],
+    sessionManager: await getSessionManager(),
+    plugins: [new ModelErrorLoggingPlugin(), new ToolErrorLoggingPlugin()],
+  });
+  return agent;
+};
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with cdk > app/index.ts 1`] = `
+"export * from './guardrails/index.js';
+export * from './agents/index.js';
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with cdk > construct 1`] = `
+"import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as url from 'node:url';
+import { CfnOutput, Names, Stack } from 'aws-cdk-lib';
+import * as bedrock from 'aws-cdk-lib/aws-bedrock';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+import { RuntimeConfig } from '../../../core/runtime-config.js';
+import { findWorkspaceRoot } from '../../../core/workspace.js';
+
+interface GuardrailPolicy {
+  blockedInputMessaging: string;
+  blockedOutputsMessaging: string;
+  deniedTopics?: { name: string; definition: string; examples?: string[] }[];
+  piiEntities?: { type: string; action: string }[];
+}
+
+// Read at synth time, anchored on the workspace root so it still resolves once
+// this file compiles to dist/.
+const policyFile = fs.readFileSync(
+  path.join(
+    findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+    'apps/test-project/src/agent/guardrail.json',
+  ),
+);
+const policy: GuardrailPolicy = JSON.parse(policyFile.toString('utf-8'));
+
+/**
+ * Properties for the TestProjectAgentGuardrail. Any CfnGuardrail property
+ * supplied here takes precedence over guardrail.json.
+ */
+export type TestProjectAgentGuardrailProps =
+  Partial<bedrock.CfnGuardrailProps> & {
+    /** The agent that applies this guardrail. It is granted bedrock:ApplyGuardrail. */
+    readonly agent: iam.IGrantable;
+  };
+
+/**
+ * An Amazon Bedrock Guardrail for TestProjectAgent, with a numbered version
+ * that changes whenever its rules change. Its ID and version are written to
+ * runtime config, where the agent reads them.
+ */
+export class TestProjectAgentGuardrail extends Construct {
+  public readonly guardrail: bedrock.CfnGuardrail;
+  public readonly version: bedrock.CfnGuardrailVersion;
+  public readonly guardrailId: string;
+  public readonly guardrailArn: string;
+  public readonly guardrailVersion: string;
+
+  constructor(
+    scope: Construct,
+    id: string,
+    props: TestProjectAgentGuardrailProps,
+  ) {
+    super(scope, id);
+
+    const { agent, ...overrides } = props;
+
+    const deniedTopics = policy.deniedTopics ?? [];
+    const piiEntities = policy.piiEntities ?? [];
+
+    this.guardrail = new bedrock.CfnGuardrail(this, 'Guardrail', {
+      name: Names.uniqueResourceName(this, {
+        maxLength: 50,
+        separator: '-',
+        allowedSpecialCharacters: '-_',
+      }),
+      blockedInputMessaging: policy.blockedInputMessaging,
+      blockedOutputsMessaging: policy.blockedOutputsMessaging,
+      ...(deniedTopics.length > 0 && {
+        topicPolicyConfig: {
+          topicsConfig: deniedTopics.map(({ name, definition, examples }) => ({
+            name,
+            definition,
+            examples,
+            type: 'DENY',
+          })),
+        },
+      }),
+      ...(piiEntities.length > 0 && {
+        sensitiveInformationPolicyConfig: {
+          piiEntitiesConfig: piiEntities.map(({ type, action }) => ({
+            type,
+            action,
+          })),
+        },
+      }),
+      ...overrides,
+    });
+
+    const hash = createHash('sha256').update(policyFile);
+    if (Object.keys(overrides).length > 0) {
+      hash.update(JSON.stringify(Stack.of(this).resolve(overrides)));
+    }
+
+    this.version = new bedrock.CfnGuardrailVersion(this, 'Version', {
+      guardrailIdentifier: this.guardrail.attrGuardrailId,
+      description: \`guardrail.json sha256 \${hash.digest('hex')}\`,
+    });
+
+    this.guardrailId = this.guardrail.attrGuardrailId;
+    this.guardrailArn = this.guardrail.attrGuardrailArn;
+    this.guardrailVersion = this.version.attrVersion;
+
+    new CfnOutput(this, 'GuardrailId', { value: this.guardrailId });
+    new CfnOutput(this, 'GuardrailVersion', { value: this.guardrailVersion });
+
+    const rc = RuntimeConfig.ensure(this);
+    rc.set('agentcore', 'guardrails', {
+      ...rc.get('agentcore').guardrails,
+      TestProjectAgent: {
+        guardrailId: this.guardrailId,
+        guardrailVersion: this.guardrailVersion,
+      },
+    });
+
+    this.grantApply(agent);
+  }
+
+  /** Grant permission to apply this guardrail. */
+  public grantApply(grantee: iam.IGrantable): iam.Grant {
+    return iam.Grant.addToPrincipal({
+      grantee,
+      actions: ['bedrock:ApplyGuardrail'],
+      resourceArns: [this.guardrailArn],
+    });
+  }
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with cdk > guardrail.json 1`] = `
+"{
+  "blockedInputMessaging": "Sorry, I can't help with that request.",
+  "blockedOutputsMessaging": "Sorry, I can't share that answer.",
+  "deniedTopics": [
+    {
+      "name": "Investment advice",
+      "definition": "Recommendations about which specific stocks, funds or other investments to buy or sell.",
+      "examples": ["Which stocks should I buy this year?"]
+    }
+  ],
+  "piiEntities": [
+    { "type": "EMAIL", "action": "ANONYMIZE" },
+    { "type": "PHONE", "action": "ANONYMIZE" },
+    { "type": "US_SOCIAL_SECURITY_NUMBER", "action": "BLOCK" }
+  ]
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with cdk > guardrail.ts 1`] = `
+"import { BedrockModel, type BedrockGuardrailConfig } from '@strands-agents/sdk';
+import {
+  type AgentCoreRuntimeConfig,
+  getAgentCoreRuntimeConfig,
+} from '@proj/agent-connection';
+
+/**
+ * This agent's entry in runtime config, written by the
+ * TestProjectAgentGuardrail construct or the test-project-agent guardrail module.
+ */
+interface GuardrailEntry {
+  guardrailId?: string;
+  guardrailVersion?: string;
+}
+
+const RUNTIME_CONFIG_KEY = 'agentcore.guardrails.TestProjectAgent';
+
+let warnedUnguarded = false;
+
+const readEntry = async (): Promise<GuardrailEntry | undefined> => {
+  const config: AgentCoreRuntimeConfig & {
+    guardrails?: Record<string, GuardrailEntry>;
+  } = await getAgentCoreRuntimeConfig();
+  return config.guardrails?.['TestProjectAgent'];
+};
+
+/**
+ * The guardrail to apply, read from runtime config on every model call
+ * (cached for 5 seconds).
+ */
+const resolveGuardrail = async (): Promise<
+  BedrockGuardrailConfig | undefined
+> => {
+  const localDev = process.env.LOCAL_DEV === 'true';
+  let entry: GuardrailEntry | undefined;
+  if (!localDev) {
+    entry = await readEntry();
+  } else if (process.env.RUNTIME_CONFIG_APP_ID) {
+    entry = await readEntry().catch(() => undefined);
+  }
+
+  if (!entry?.guardrailId || !entry.guardrailVersion) {
+    if (!localDev) {
+      throw new Error(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}. Add the TestProjectAgentGuardrail construct (CDK) or the guardrails/test-project-agent module (Terraform) to your infrastructure.\`,
+      );
+    }
+    if (!warnedUnguarded) {
+      warnedUnguarded = true;
+      console.warn(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}, so the agent is running without a guardrail (LOCAL_DEV=true).\`,
+      );
+    }
+    return undefined;
+  }
+
+  if (!/^[1-9][0-9]*$/.test(entry.guardrailVersion)) {
+    throw new Error(
+      \`The guardrail version in runtime config at \${RUNTIME_CONFIG_KEY} must be a numbered guardrail version, but is \${entry.guardrailVersion}.\`,
+    );
+  }
+
+  return {
+    guardrailIdentifier: entry.guardrailId,
+    guardrailVersion: entry.guardrailVersion,
+    trace: 'enabled',
+  };
+};
+
+/**
+ * A Bedrock model that applies this agent's guardrail from runtime config
+ * before each model call, so a new guardrail version applies without a
+ * restart.
+ */
+export class GuardrailedBedrockModel extends BedrockModel {
+  override async *stream(...args: Parameters<BedrockModel['stream']>) {
+    this.updateConfig({ guardrailConfig: await resolveGuardrail() });
+    return yield* super.stream(...args);
+  }
+}
+
+/**
+ * The Bedrock model with this agent's guardrail applied.
+ */
+export const getGuardrailedModel = (): BedrockModel =>
+  new GuardrailedBedrockModel();
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with cdk > guardrails/index.ts 1`] = `
+"export * from './test-project-agent/test-project-agent-guardrail.js';
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with terraform > agent.ts 1`] = `
+"import { getGuardrailedModel } from './guardrail.js';
+import { Agent, tool } from '@strands-agents/sdk';
+import {
+  ModelErrorLoggingPlugin,
+  ToolErrorLoggingPlugin,
+} from '@proj/agent-connection';
+import { getSessionManager } from './session.js';
+import { z } from 'zod';
+
+const multiply = tool({
+  name: 'Multiply',
+  description: 'Multiply two numbers',
+  inputSchema: z.object({
+    a: z.number(),
+    b: z.number(),
+  }),
+  callback: ({ a, b }) => a * b,
+});
+
+export const getAgent = async () => {
+  const agent = new Agent({
+    model: getGuardrailedModel(),
+    systemPrompt: \`You are a mathematical wizard.
+  Use your tools for mathematical tasks.
+  Refer to tools as your 'spellbook'.\`,
+    tools: [multiply],
+    sessionManager: await getSessionManager(),
+    plugins: [new ModelErrorLoggingPlugin(), new ToolErrorLoggingPlugin()],
+  });
+  return agent;
+};
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with terraform > guardrail.json 1`] = `
+"{
+  "blockedInputMessaging": "Sorry, I can't help with that request.",
+  "blockedOutputsMessaging": "Sorry, I can't share that answer.",
+  "deniedTopics": [
+    {
+      "name": "Investment advice",
+      "definition": "Recommendations about which specific stocks, funds or other investments to buy or sell.",
+      "examples": ["Which stocks should I buy this year?"]
+    }
+  ],
+  "piiEntities": [
+    { "type": "EMAIL", "action": "ANONYMIZE" },
+    { "type": "PHONE", "action": "ANONYMIZE" },
+    { "type": "US_SOCIAL_SECURITY_NUMBER", "action": "BLOCK" }
+  ]
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with terraform > guardrail.ts 1`] = `
+"import { BedrockModel, type BedrockGuardrailConfig } from '@strands-agents/sdk';
+import {
+  type AgentCoreRuntimeConfig,
+  getAgentCoreRuntimeConfig,
+} from '@proj/agent-connection';
+
+/**
+ * This agent's entry in runtime config, written by the
+ * TestProjectAgentGuardrail construct or the test-project-agent guardrail module.
+ */
+interface GuardrailEntry {
+  guardrailId?: string;
+  guardrailVersion?: string;
+}
+
+const RUNTIME_CONFIG_KEY = 'agentcore.guardrails.TestProjectAgent';
+
+let warnedUnguarded = false;
+
+const readEntry = async (): Promise<GuardrailEntry | undefined> => {
+  const config: AgentCoreRuntimeConfig & {
+    guardrails?: Record<string, GuardrailEntry>;
+  } = await getAgentCoreRuntimeConfig();
+  return config.guardrails?.['TestProjectAgent'];
+};
+
+/**
+ * The guardrail to apply, read from runtime config on every model call
+ * (cached for 5 seconds).
+ */
+const resolveGuardrail = async (): Promise<
+  BedrockGuardrailConfig | undefined
+> => {
+  const localDev = process.env.LOCAL_DEV === 'true';
+  let entry: GuardrailEntry | undefined;
+  if (!localDev) {
+    entry = await readEntry();
+  } else if (process.env.RUNTIME_CONFIG_APP_ID) {
+    entry = await readEntry().catch(() => undefined);
+  }
+
+  if (!entry?.guardrailId || !entry.guardrailVersion) {
+    if (!localDev) {
+      throw new Error(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}. Add the TestProjectAgentGuardrail construct (CDK) or the guardrails/test-project-agent module (Terraform) to your infrastructure.\`,
+      );
+    }
+    if (!warnedUnguarded) {
+      warnedUnguarded = true;
+      console.warn(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}, so the agent is running without a guardrail (LOCAL_DEV=true).\`,
+      );
+    }
+    return undefined;
+  }
+
+  if (!/^[1-9][0-9]*$/.test(entry.guardrailVersion)) {
+    throw new Error(
+      \`The guardrail version in runtime config at \${RUNTIME_CONFIG_KEY} must be a numbered guardrail version, but is \${entry.guardrailVersion}.\`,
+    );
+  }
+
+  return {
+    guardrailIdentifier: entry.guardrailId,
+    guardrailVersion: entry.guardrailVersion,
+    trace: 'enabled',
+  };
+};
+
+/**
+ * A Bedrock model that applies this agent's guardrail from runtime config
+ * before each model call, so a new guardrail version applies without a
+ * restart.
+ */
+export class GuardrailedBedrockModel extends BedrockModel {
+  override async *stream(...args: Parameters<BedrockModel['stream']>) {
+    this.updateConfig({ guardrailConfig: await resolveGuardrail() });
+    return yield* super.stream(...args);
+  }
+}
+
+/**
+ * The Bedrock model with this agent's guardrail applied.
+ */
+export const getGuardrailedModel = (): BedrockModel =>
+  new GuardrailedBedrockModel();
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol a2a > should generate the guardrail with terraform > module 1`] = `
+"terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.69.1"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.1"
+    }
+  }
+}
+
+variable "tags" {
+  description = "Tags to apply to resources"
+  type        = map(string)
+  default     = {}
+}
+
+locals {
+  policy_file = "\${path.module}/../../../../../../../apps/test-project/src/agent/guardrail.json"
+  policy      = jsondecode(file(local.policy_file))
+  name_prefix = "test-project-agent-guardrail"
+}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+resource "aws_bedrock_guardrail" "this" {
+  name                      = "\${local.name_prefix}-\${random_id.unique_suffix.hex}"
+  blocked_input_messaging   = local.policy.blockedInputMessaging
+  blocked_outputs_messaging = local.policy.blockedOutputsMessaging
+
+  dynamic "topic_policy_config" {
+    for_each = length(try(local.policy.deniedTopics, [])) > 0 ? [1] : []
+    content {
+      dynamic "topics_config" {
+        for_each = local.policy.deniedTopics
+        content {
+          name       = topics_config.value.name
+          definition = topics_config.value.definition
+          examples   = try(topics_config.value.examples, [])
+          type       = "DENY"
+        }
+      }
+    }
+  }
+
+  dynamic "sensitive_information_policy_config" {
+    for_each = length(try(local.policy.piiEntities, [])) > 0 ? [1] : []
+    content {
+      dynamic "pii_entities_config" {
+        for_each = local.policy.piiEntities
+        content {
+          type   = pii_entities_config.value.type
+          action = pii_entities_config.value.action
+        }
+      }
+    }
+  }
+
+  tags = var.tags
+}
+
+resource "aws_bedrock_guardrail_version" "this" {
+  guardrail_arn = aws_bedrock_guardrail.this.guardrail_arn
+  description   = "guardrail.json sha256 \${filesha256(local.policy_file)}"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+module "add_guardrail_to_runtime_config" {
+  source = "../../../core/runtime-config/entry"
+
+  namespace = "agentcore"
+  key       = "guardrails"
+  value     = { "TestProjectAgent" = { guardrailId = aws_bedrock_guardrail.this.guardrail_id, guardrailVersion = aws_bedrock_guardrail_version.this.version } }
+}
+
+output "guardrail_id" {
+  description = "ID of the guardrail"
+  value       = aws_bedrock_guardrail.this.guardrail_id
+}
+
+output "guardrail_arn" {
+  description = "ARN of the guardrail"
+  value       = aws_bedrock_guardrail.this.guardrail_arn
+}
+
+output "guardrail_version" {
+  description = "Numbered version of the guardrail"
+  value       = aws_bedrock_guardrail_version.this.version
+}
+
+output "iam_policy_statements" {
+  description = "IAM policy statements that allow the agent to apply the guardrail"
+  value = [
+    {
+      Effect   = "Allow"
+      Action   = ["bedrock:ApplyGuardrail"]
+      Resource = [aws_bedrock_guardrail.this.guardrail_arn]
+    }
+  ]
+  depends_on = [module.add_guardrail_to_runtime_config]
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with cdk > agent.ts 1`] = `
+"import { getGuardrailedModel } from './guardrail.js';
+import { Agent, tool } from '@strands-agents/sdk';
+import { z } from 'zod';
+
+const multiply = tool({
+  name: 'Multiply',
+  description: 'Multiply two numbers',
+  inputSchema: z.object({
+    a: z.number(),
+    b: z.number(),
+  }),
+  callback: ({ a, b }) => a * b,
+});
+
+export const getAgent = async () => {
+  const agent = new Agent({
+    model: getGuardrailedModel(),
+    systemPrompt: \`You are a mathematical wizard.
+  Use your tools for mathematical tasks.
+  Refer to tools as your 'spellbook'.\`,
+    tools: [multiply],
+  });
+  return agent;
+};
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with cdk > app/index.ts 1`] = `
+"export * from './guardrails/index.js';
+export * from './agents/index.js';
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with cdk > construct 1`] = `
+"import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as url from 'node:url';
+import { CfnOutput, Names, Stack } from 'aws-cdk-lib';
+import * as bedrock from 'aws-cdk-lib/aws-bedrock';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+import { RuntimeConfig } from '../../../core/runtime-config.js';
+import { findWorkspaceRoot } from '../../../core/workspace.js';
+
+interface GuardrailPolicy {
+  blockedInputMessaging: string;
+  blockedOutputsMessaging: string;
+  deniedTopics?: { name: string; definition: string; examples?: string[] }[];
+  piiEntities?: { type: string; action: string }[];
+}
+
+// Read at synth time, anchored on the workspace root so it still resolves once
+// this file compiles to dist/.
+const policyFile = fs.readFileSync(
+  path.join(
+    findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+    'apps/test-project/src/agent/guardrail.json',
+  ),
+);
+const policy: GuardrailPolicy = JSON.parse(policyFile.toString('utf-8'));
+
+/**
+ * Properties for the TestProjectAgentGuardrail. Any CfnGuardrail property
+ * supplied here takes precedence over guardrail.json.
+ */
+export type TestProjectAgentGuardrailProps =
+  Partial<bedrock.CfnGuardrailProps> & {
+    /** The agent that applies this guardrail. It is granted bedrock:ApplyGuardrail. */
+    readonly agent: iam.IGrantable;
+  };
+
+/**
+ * An Amazon Bedrock Guardrail for TestProjectAgent, with a numbered version
+ * that changes whenever its rules change. Its ID and version are written to
+ * runtime config, where the agent reads them.
+ */
+export class TestProjectAgentGuardrail extends Construct {
+  public readonly guardrail: bedrock.CfnGuardrail;
+  public readonly version: bedrock.CfnGuardrailVersion;
+  public readonly guardrailId: string;
+  public readonly guardrailArn: string;
+  public readonly guardrailVersion: string;
+
+  constructor(
+    scope: Construct,
+    id: string,
+    props: TestProjectAgentGuardrailProps,
+  ) {
+    super(scope, id);
+
+    const { agent, ...overrides } = props;
+
+    const deniedTopics = policy.deniedTopics ?? [];
+    const piiEntities = policy.piiEntities ?? [];
+
+    this.guardrail = new bedrock.CfnGuardrail(this, 'Guardrail', {
+      name: Names.uniqueResourceName(this, {
+        maxLength: 50,
+        separator: '-',
+        allowedSpecialCharacters: '-_',
+      }),
+      blockedInputMessaging: policy.blockedInputMessaging,
+      blockedOutputsMessaging: policy.blockedOutputsMessaging,
+      ...(deniedTopics.length > 0 && {
+        topicPolicyConfig: {
+          topicsConfig: deniedTopics.map(({ name, definition, examples }) => ({
+            name,
+            definition,
+            examples,
+            type: 'DENY',
+          })),
+        },
+      }),
+      ...(piiEntities.length > 0 && {
+        sensitiveInformationPolicyConfig: {
+          piiEntitiesConfig: piiEntities.map(({ type, action }) => ({
+            type,
+            action,
+          })),
+        },
+      }),
+      ...overrides,
+    });
+
+    const hash = createHash('sha256').update(policyFile);
+    if (Object.keys(overrides).length > 0) {
+      hash.update(JSON.stringify(Stack.of(this).resolve(overrides)));
+    }
+
+    this.version = new bedrock.CfnGuardrailVersion(this, 'Version', {
+      guardrailIdentifier: this.guardrail.attrGuardrailId,
+      description: \`guardrail.json sha256 \${hash.digest('hex')}\`,
+    });
+
+    this.guardrailId = this.guardrail.attrGuardrailId;
+    this.guardrailArn = this.guardrail.attrGuardrailArn;
+    this.guardrailVersion = this.version.attrVersion;
+
+    new CfnOutput(this, 'GuardrailId', { value: this.guardrailId });
+    new CfnOutput(this, 'GuardrailVersion', { value: this.guardrailVersion });
+
+    const rc = RuntimeConfig.ensure(this);
+    rc.set('agentcore', 'guardrails', {
+      ...rc.get('agentcore').guardrails,
+      TestProjectAgent: {
+        guardrailId: this.guardrailId,
+        guardrailVersion: this.guardrailVersion,
+      },
+    });
+
+    this.grantApply(agent);
+  }
+
+  /** Grant permission to apply this guardrail. */
+  public grantApply(grantee: iam.IGrantable): iam.Grant {
+    return iam.Grant.addToPrincipal({
+      grantee,
+      actions: ['bedrock:ApplyGuardrail'],
+      resourceArns: [this.guardrailArn],
+    });
+  }
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with cdk > guardrail.json 1`] = `
+"{
+  "blockedInputMessaging": "Sorry, I can't help with that request.",
+  "blockedOutputsMessaging": "Sorry, I can't share that answer.",
+  "deniedTopics": [
+    {
+      "name": "Investment advice",
+      "definition": "Recommendations about which specific stocks, funds or other investments to buy or sell.",
+      "examples": ["Which stocks should I buy this year?"]
+    }
+  ],
+  "piiEntities": [
+    { "type": "EMAIL", "action": "ANONYMIZE" },
+    { "type": "PHONE", "action": "ANONYMIZE" },
+    { "type": "US_SOCIAL_SECURITY_NUMBER", "action": "BLOCK" }
+  ]
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with cdk > guardrail.ts 1`] = `
+"import { BedrockModel, type BedrockGuardrailConfig } from '@strands-agents/sdk';
+import {
+  type AgentCoreRuntimeConfig,
+  getAgentCoreRuntimeConfig,
+} from '@proj/agent-connection';
+
+/**
+ * This agent's entry in runtime config, written by the
+ * TestProjectAgentGuardrail construct or the test-project-agent guardrail module.
+ */
+interface GuardrailEntry {
+  guardrailId?: string;
+  guardrailVersion?: string;
+}
+
+const RUNTIME_CONFIG_KEY = 'agentcore.guardrails.TestProjectAgent';
+
+let warnedUnguarded = false;
+
+const readEntry = async (): Promise<GuardrailEntry | undefined> => {
+  const config: AgentCoreRuntimeConfig & {
+    guardrails?: Record<string, GuardrailEntry>;
+  } = await getAgentCoreRuntimeConfig();
+  return config.guardrails?.['TestProjectAgent'];
+};
+
+/**
+ * The guardrail to apply, read from runtime config on every model call
+ * (cached for 5 seconds).
+ */
+const resolveGuardrail = async (): Promise<
+  BedrockGuardrailConfig | undefined
+> => {
+  const localDev = process.env.LOCAL_DEV === 'true';
+  let entry: GuardrailEntry | undefined;
+  if (!localDev) {
+    entry = await readEntry();
+  } else if (process.env.RUNTIME_CONFIG_APP_ID) {
+    entry = await readEntry().catch(() => undefined);
+  }
+
+  if (!entry?.guardrailId || !entry.guardrailVersion) {
+    if (!localDev) {
+      throw new Error(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}. Add the TestProjectAgentGuardrail construct (CDK) or the guardrails/test-project-agent module (Terraform) to your infrastructure.\`,
+      );
+    }
+    if (!warnedUnguarded) {
+      warnedUnguarded = true;
+      console.warn(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}, so the agent is running without a guardrail (LOCAL_DEV=true).\`,
+      );
+    }
+    return undefined;
+  }
+
+  if (!/^[1-9][0-9]*$/.test(entry.guardrailVersion)) {
+    throw new Error(
+      \`The guardrail version in runtime config at \${RUNTIME_CONFIG_KEY} must be a numbered guardrail version, but is \${entry.guardrailVersion}.\`,
+    );
+  }
+
+  return {
+    guardrailIdentifier: entry.guardrailId,
+    guardrailVersion: entry.guardrailVersion,
+    trace: 'enabled',
+  };
+};
+
+/**
+ * A Bedrock model that applies this agent's guardrail from runtime config
+ * before each model call, so a new guardrail version applies without a
+ * restart.
+ */
+export class GuardrailedBedrockModel extends BedrockModel {
+  override async *stream(...args: Parameters<BedrockModel['stream']>) {
+    this.updateConfig({ guardrailConfig: await resolveGuardrail() });
+    return yield* super.stream(...args);
+  }
+}
+
+/**
+ * The Bedrock model with this agent's guardrail applied.
+ */
+export const getGuardrailedModel = (): BedrockModel =>
+  new GuardrailedBedrockModel();
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with cdk > guardrails/index.ts 1`] = `
+"export * from './test-project-agent/test-project-agent-guardrail.js';
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with terraform > agent.ts 1`] = `
+"import { getGuardrailedModel } from './guardrail.js';
+import { Agent, tool } from '@strands-agents/sdk';
+import { z } from 'zod';
+
+const multiply = tool({
+  name: 'Multiply',
+  description: 'Multiply two numbers',
+  inputSchema: z.object({
+    a: z.number(),
+    b: z.number(),
+  }),
+  callback: ({ a, b }) => a * b,
+});
+
+export const getAgent = async () => {
+  const agent = new Agent({
+    model: getGuardrailedModel(),
+    systemPrompt: \`You are a mathematical wizard.
+  Use your tools for mathematical tasks.
+  Refer to tools as your 'spellbook'.\`,
+    tools: [multiply],
+  });
+  return agent;
+};
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with terraform > guardrail.json 1`] = `
+"{
+  "blockedInputMessaging": "Sorry, I can't help with that request.",
+  "blockedOutputsMessaging": "Sorry, I can't share that answer.",
+  "deniedTopics": [
+    {
+      "name": "Investment advice",
+      "definition": "Recommendations about which specific stocks, funds or other investments to buy or sell.",
+      "examples": ["Which stocks should I buy this year?"]
+    }
+  ],
+  "piiEntities": [
+    { "type": "EMAIL", "action": "ANONYMIZE" },
+    { "type": "PHONE", "action": "ANONYMIZE" },
+    { "type": "US_SOCIAL_SECURITY_NUMBER", "action": "BLOCK" }
+  ]
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with terraform > guardrail.ts 1`] = `
+"import { BedrockModel, type BedrockGuardrailConfig } from '@strands-agents/sdk';
+import {
+  type AgentCoreRuntimeConfig,
+  getAgentCoreRuntimeConfig,
+} from '@proj/agent-connection';
+
+/**
+ * This agent's entry in runtime config, written by the
+ * TestProjectAgentGuardrail construct or the test-project-agent guardrail module.
+ */
+interface GuardrailEntry {
+  guardrailId?: string;
+  guardrailVersion?: string;
+}
+
+const RUNTIME_CONFIG_KEY = 'agentcore.guardrails.TestProjectAgent';
+
+let warnedUnguarded = false;
+
+const readEntry = async (): Promise<GuardrailEntry | undefined> => {
+  const config: AgentCoreRuntimeConfig & {
+    guardrails?: Record<string, GuardrailEntry>;
+  } = await getAgentCoreRuntimeConfig();
+  return config.guardrails?.['TestProjectAgent'];
+};
+
+/**
+ * The guardrail to apply, read from runtime config on every model call
+ * (cached for 5 seconds).
+ */
+const resolveGuardrail = async (): Promise<
+  BedrockGuardrailConfig | undefined
+> => {
+  const localDev = process.env.LOCAL_DEV === 'true';
+  let entry: GuardrailEntry | undefined;
+  if (!localDev) {
+    entry = await readEntry();
+  } else if (process.env.RUNTIME_CONFIG_APP_ID) {
+    entry = await readEntry().catch(() => undefined);
+  }
+
+  if (!entry?.guardrailId || !entry.guardrailVersion) {
+    if (!localDev) {
+      throw new Error(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}. Add the TestProjectAgentGuardrail construct (CDK) or the guardrails/test-project-agent module (Terraform) to your infrastructure.\`,
+      );
+    }
+    if (!warnedUnguarded) {
+      warnedUnguarded = true;
+      console.warn(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}, so the agent is running without a guardrail (LOCAL_DEV=true).\`,
+      );
+    }
+    return undefined;
+  }
+
+  if (!/^[1-9][0-9]*$/.test(entry.guardrailVersion)) {
+    throw new Error(
+      \`The guardrail version in runtime config at \${RUNTIME_CONFIG_KEY} must be a numbered guardrail version, but is \${entry.guardrailVersion}.\`,
+    );
+  }
+
+  return {
+    guardrailIdentifier: entry.guardrailId,
+    guardrailVersion: entry.guardrailVersion,
+    trace: 'enabled',
+  };
+};
+
+/**
+ * A Bedrock model that applies this agent's guardrail from runtime config
+ * before each model call, so a new guardrail version applies without a
+ * restart.
+ */
+export class GuardrailedBedrockModel extends BedrockModel {
+  override async *stream(...args: Parameters<BedrockModel['stream']>) {
+    this.updateConfig({ guardrailConfig: await resolveGuardrail() });
+    return yield* super.stream(...args);
+  }
+}
+
+/**
+ * The Bedrock model with this agent's guardrail applied.
+ */
+export const getGuardrailedModel = (): BedrockModel =>
+  new GuardrailedBedrockModel();
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol ag-ui > should generate the guardrail with terraform > module 1`] = `
+"terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.69.1"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.1"
+    }
+  }
+}
+
+variable "tags" {
+  description = "Tags to apply to resources"
+  type        = map(string)
+  default     = {}
+}
+
+locals {
+  policy_file = "\${path.module}/../../../../../../../apps/test-project/src/agent/guardrail.json"
+  policy      = jsondecode(file(local.policy_file))
+  name_prefix = "test-project-agent-guardrail"
+}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+resource "aws_bedrock_guardrail" "this" {
+  name                      = "\${local.name_prefix}-\${random_id.unique_suffix.hex}"
+  blocked_input_messaging   = local.policy.blockedInputMessaging
+  blocked_outputs_messaging = local.policy.blockedOutputsMessaging
+
+  dynamic "topic_policy_config" {
+    for_each = length(try(local.policy.deniedTopics, [])) > 0 ? [1] : []
+    content {
+      dynamic "topics_config" {
+        for_each = local.policy.deniedTopics
+        content {
+          name       = topics_config.value.name
+          definition = topics_config.value.definition
+          examples   = try(topics_config.value.examples, [])
+          type       = "DENY"
+        }
+      }
+    }
+  }
+
+  dynamic "sensitive_information_policy_config" {
+    for_each = length(try(local.policy.piiEntities, [])) > 0 ? [1] : []
+    content {
+      dynamic "pii_entities_config" {
+        for_each = local.policy.piiEntities
+        content {
+          type   = pii_entities_config.value.type
+          action = pii_entities_config.value.action
+        }
+      }
+    }
+  }
+
+  tags = var.tags
+}
+
+resource "aws_bedrock_guardrail_version" "this" {
+  guardrail_arn = aws_bedrock_guardrail.this.guardrail_arn
+  description   = "guardrail.json sha256 \${filesha256(local.policy_file)}"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+module "add_guardrail_to_runtime_config" {
+  source = "../../../core/runtime-config/entry"
+
+  namespace = "agentcore"
+  key       = "guardrails"
+  value     = { "TestProjectAgent" = { guardrailId = aws_bedrock_guardrail.this.guardrail_id, guardrailVersion = aws_bedrock_guardrail_version.this.version } }
+}
+
+output "guardrail_id" {
+  description = "ID of the guardrail"
+  value       = aws_bedrock_guardrail.this.guardrail_id
+}
+
+output "guardrail_arn" {
+  description = "ARN of the guardrail"
+  value       = aws_bedrock_guardrail.this.guardrail_arn
+}
+
+output "guardrail_version" {
+  description = "Numbered version of the guardrail"
+  value       = aws_bedrock_guardrail_version.this.version
+}
+
+output "iam_policy_statements" {
+  description = "IAM policy statements that allow the agent to apply the guardrail"
+  value = [
+    {
+      Effect   = "Allow"
+      Action   = ["bedrock:ApplyGuardrail"]
+      Resource = [aws_bedrock_guardrail.this.guardrail_arn]
+    }
+  ]
+  depends_on = [module.add_guardrail_to_runtime_config]
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with cdk > agent.ts 1`] = `
+"import { getGuardrailedModel } from './guardrail.js';
+import { Agent, tool } from '@strands-agents/sdk';
+import {
+  ModelErrorLoggingPlugin,
+  ToolErrorLoggingPlugin,
+} from '@proj/agent-connection';
+import { getSessionManager } from './session.js';
+import { z } from 'zod';
+
+const multiply = tool({
+  name: 'Multiply',
+  description: 'Multiply two numbers',
+  inputSchema: z.object({
+    a: z.number(),
+    b: z.number(),
+  }),
+  callback: ({ a, b }) => a * b,
+});
+
+export const getAgent = async () => {
+  const agent = new Agent({
+    model: getGuardrailedModel(),
+    systemPrompt: \`You are a mathematical wizard.
+  Use your tools for mathematical tasks.
+  Refer to tools as your 'spellbook'.\`,
+    tools: [multiply],
+    sessionManager: await getSessionManager(),
+    plugins: [new ModelErrorLoggingPlugin(), new ToolErrorLoggingPlugin()],
+  });
+  return agent;
+};
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with cdk > app/index.ts 1`] = `
+"export * from './guardrails/index.js';
+export * from './agents/index.js';
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with cdk > construct 1`] = `
+"import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as url from 'node:url';
+import { CfnOutput, Names, Stack } from 'aws-cdk-lib';
+import * as bedrock from 'aws-cdk-lib/aws-bedrock';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+import { RuntimeConfig } from '../../../core/runtime-config.js';
+import { findWorkspaceRoot } from '../../../core/workspace.js';
+
+interface GuardrailPolicy {
+  blockedInputMessaging: string;
+  blockedOutputsMessaging: string;
+  deniedTopics?: { name: string; definition: string; examples?: string[] }[];
+  piiEntities?: { type: string; action: string }[];
+}
+
+// Read at synth time, anchored on the workspace root so it still resolves once
+// this file compiles to dist/.
+const policyFile = fs.readFileSync(
+  path.join(
+    findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+    'apps/test-project/src/agent/guardrail.json',
+  ),
+);
+const policy: GuardrailPolicy = JSON.parse(policyFile.toString('utf-8'));
+
+/**
+ * Properties for the TestProjectAgentGuardrail. Any CfnGuardrail property
+ * supplied here takes precedence over guardrail.json.
+ */
+export type TestProjectAgentGuardrailProps =
+  Partial<bedrock.CfnGuardrailProps> & {
+    /** The agent that applies this guardrail. It is granted bedrock:ApplyGuardrail. */
+    readonly agent: iam.IGrantable;
+  };
+
+/**
+ * An Amazon Bedrock Guardrail for TestProjectAgent, with a numbered version
+ * that changes whenever its rules change. Its ID and version are written to
+ * runtime config, where the agent reads them.
+ */
+export class TestProjectAgentGuardrail extends Construct {
+  public readonly guardrail: bedrock.CfnGuardrail;
+  public readonly version: bedrock.CfnGuardrailVersion;
+  public readonly guardrailId: string;
+  public readonly guardrailArn: string;
+  public readonly guardrailVersion: string;
+
+  constructor(
+    scope: Construct,
+    id: string,
+    props: TestProjectAgentGuardrailProps,
+  ) {
+    super(scope, id);
+
+    const { agent, ...overrides } = props;
+
+    const deniedTopics = policy.deniedTopics ?? [];
+    const piiEntities = policy.piiEntities ?? [];
+
+    this.guardrail = new bedrock.CfnGuardrail(this, 'Guardrail', {
+      name: Names.uniqueResourceName(this, {
+        maxLength: 50,
+        separator: '-',
+        allowedSpecialCharacters: '-_',
+      }),
+      blockedInputMessaging: policy.blockedInputMessaging,
+      blockedOutputsMessaging: policy.blockedOutputsMessaging,
+      ...(deniedTopics.length > 0 && {
+        topicPolicyConfig: {
+          topicsConfig: deniedTopics.map(({ name, definition, examples }) => ({
+            name,
+            definition,
+            examples,
+            type: 'DENY',
+          })),
+        },
+      }),
+      ...(piiEntities.length > 0 && {
+        sensitiveInformationPolicyConfig: {
+          piiEntitiesConfig: piiEntities.map(({ type, action }) => ({
+            type,
+            action,
+          })),
+        },
+      }),
+      ...overrides,
+    });
+
+    const hash = createHash('sha256').update(policyFile);
+    if (Object.keys(overrides).length > 0) {
+      hash.update(JSON.stringify(Stack.of(this).resolve(overrides)));
+    }
+
+    this.version = new bedrock.CfnGuardrailVersion(this, 'Version', {
+      guardrailIdentifier: this.guardrail.attrGuardrailId,
+      description: \`guardrail.json sha256 \${hash.digest('hex')}\`,
+    });
+
+    this.guardrailId = this.guardrail.attrGuardrailId;
+    this.guardrailArn = this.guardrail.attrGuardrailArn;
+    this.guardrailVersion = this.version.attrVersion;
+
+    new CfnOutput(this, 'GuardrailId', { value: this.guardrailId });
+    new CfnOutput(this, 'GuardrailVersion', { value: this.guardrailVersion });
+
+    const rc = RuntimeConfig.ensure(this);
+    rc.set('agentcore', 'guardrails', {
+      ...rc.get('agentcore').guardrails,
+      TestProjectAgent: {
+        guardrailId: this.guardrailId,
+        guardrailVersion: this.guardrailVersion,
+      },
+    });
+
+    this.grantApply(agent);
+  }
+
+  /** Grant permission to apply this guardrail. */
+  public grantApply(grantee: iam.IGrantable): iam.Grant {
+    return iam.Grant.addToPrincipal({
+      grantee,
+      actions: ['bedrock:ApplyGuardrail'],
+      resourceArns: [this.guardrailArn],
+    });
+  }
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with cdk > guardrail.json 1`] = `
+"{
+  "blockedInputMessaging": "Sorry, I can't help with that request.",
+  "blockedOutputsMessaging": "Sorry, I can't share that answer.",
+  "deniedTopics": [
+    {
+      "name": "Investment advice",
+      "definition": "Recommendations about which specific stocks, funds or other investments to buy or sell.",
+      "examples": ["Which stocks should I buy this year?"]
+    }
+  ],
+  "piiEntities": [
+    { "type": "EMAIL", "action": "ANONYMIZE" },
+    { "type": "PHONE", "action": "ANONYMIZE" },
+    { "type": "US_SOCIAL_SECURITY_NUMBER", "action": "BLOCK" }
+  ]
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with cdk > guardrail.ts 1`] = `
+"import { BedrockModel, type BedrockGuardrailConfig } from '@strands-agents/sdk';
+import {
+  type AgentCoreRuntimeConfig,
+  getAgentCoreRuntimeConfig,
+} from '@proj/agent-connection';
+
+/**
+ * This agent's entry in runtime config, written by the
+ * TestProjectAgentGuardrail construct or the test-project-agent guardrail module.
+ */
+interface GuardrailEntry {
+  guardrailId?: string;
+  guardrailVersion?: string;
+}
+
+const RUNTIME_CONFIG_KEY = 'agentcore.guardrails.TestProjectAgent';
+
+let warnedUnguarded = false;
+
+const readEntry = async (): Promise<GuardrailEntry | undefined> => {
+  const config: AgentCoreRuntimeConfig & {
+    guardrails?: Record<string, GuardrailEntry>;
+  } = await getAgentCoreRuntimeConfig();
+  return config.guardrails?.['TestProjectAgent'];
+};
+
+/**
+ * The guardrail to apply, read from runtime config on every model call
+ * (cached for 5 seconds).
+ */
+const resolveGuardrail = async (): Promise<
+  BedrockGuardrailConfig | undefined
+> => {
+  const localDev = process.env.LOCAL_DEV === 'true';
+  let entry: GuardrailEntry | undefined;
+  if (!localDev) {
+    entry = await readEntry();
+  } else if (process.env.RUNTIME_CONFIG_APP_ID) {
+    entry = await readEntry().catch(() => undefined);
+  }
+
+  if (!entry?.guardrailId || !entry.guardrailVersion) {
+    if (!localDev) {
+      throw new Error(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}. Add the TestProjectAgentGuardrail construct (CDK) or the guardrails/test-project-agent module (Terraform) to your infrastructure.\`,
+      );
+    }
+    if (!warnedUnguarded) {
+      warnedUnguarded = true;
+      console.warn(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}, so the agent is running without a guardrail (LOCAL_DEV=true).\`,
+      );
+    }
+    return undefined;
+  }
+
+  if (!/^[1-9][0-9]*$/.test(entry.guardrailVersion)) {
+    throw new Error(
+      \`The guardrail version in runtime config at \${RUNTIME_CONFIG_KEY} must be a numbered guardrail version, but is \${entry.guardrailVersion}.\`,
+    );
+  }
+
+  return {
+    guardrailIdentifier: entry.guardrailId,
+    guardrailVersion: entry.guardrailVersion,
+    trace: 'enabled',
+  };
+};
+
+/**
+ * A Bedrock model that applies this agent's guardrail from runtime config
+ * before each model call, so a new guardrail version applies without a
+ * restart.
+ */
+export class GuardrailedBedrockModel extends BedrockModel {
+  override async *stream(...args: Parameters<BedrockModel['stream']>) {
+    this.updateConfig({ guardrailConfig: await resolveGuardrail() });
+    return yield* super.stream(...args);
+  }
+}
+
+/**
+ * The Bedrock model with this agent's guardrail applied.
+ */
+export const getGuardrailedModel = (): BedrockModel =>
+  new GuardrailedBedrockModel();
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with cdk > guardrails/index.ts 1`] = `
+"export * from './test-project-agent/test-project-agent-guardrail.js';
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with terraform > agent.ts 1`] = `
+"import { getGuardrailedModel } from './guardrail.js';
+import { Agent, tool } from '@strands-agents/sdk';
+import {
+  ModelErrorLoggingPlugin,
+  ToolErrorLoggingPlugin,
+} from '@proj/agent-connection';
+import { getSessionManager } from './session.js';
+import { z } from 'zod';
+
+const multiply = tool({
+  name: 'Multiply',
+  description: 'Multiply two numbers',
+  inputSchema: z.object({
+    a: z.number(),
+    b: z.number(),
+  }),
+  callback: ({ a, b }) => a * b,
+});
+
+export const getAgent = async () => {
+  const agent = new Agent({
+    model: getGuardrailedModel(),
+    systemPrompt: \`You are a mathematical wizard.
+  Use your tools for mathematical tasks.
+  Refer to tools as your 'spellbook'.\`,
+    tools: [multiply],
+    sessionManager: await getSessionManager(),
+    plugins: [new ModelErrorLoggingPlugin(), new ToolErrorLoggingPlugin()],
+  });
+  return agent;
+};
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with terraform > guardrail.json 1`] = `
+"{
+  "blockedInputMessaging": "Sorry, I can't help with that request.",
+  "blockedOutputsMessaging": "Sorry, I can't share that answer.",
+  "deniedTopics": [
+    {
+      "name": "Investment advice",
+      "definition": "Recommendations about which specific stocks, funds or other investments to buy or sell.",
+      "examples": ["Which stocks should I buy this year?"]
+    }
+  ],
+  "piiEntities": [
+    { "type": "EMAIL", "action": "ANONYMIZE" },
+    { "type": "PHONE", "action": "ANONYMIZE" },
+    { "type": "US_SOCIAL_SECURITY_NUMBER", "action": "BLOCK" }
+  ]
+}
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with terraform > guardrail.ts 1`] = `
+"import { BedrockModel, type BedrockGuardrailConfig } from '@strands-agents/sdk';
+import {
+  type AgentCoreRuntimeConfig,
+  getAgentCoreRuntimeConfig,
+} from '@proj/agent-connection';
+
+/**
+ * This agent's entry in runtime config, written by the
+ * TestProjectAgentGuardrail construct or the test-project-agent guardrail module.
+ */
+interface GuardrailEntry {
+  guardrailId?: string;
+  guardrailVersion?: string;
+}
+
+const RUNTIME_CONFIG_KEY = 'agentcore.guardrails.TestProjectAgent';
+
+let warnedUnguarded = false;
+
+const readEntry = async (): Promise<GuardrailEntry | undefined> => {
+  const config: AgentCoreRuntimeConfig & {
+    guardrails?: Record<string, GuardrailEntry>;
+  } = await getAgentCoreRuntimeConfig();
+  return config.guardrails?.['TestProjectAgent'];
+};
+
+/**
+ * The guardrail to apply, read from runtime config on every model call
+ * (cached for 5 seconds).
+ */
+const resolveGuardrail = async (): Promise<
+  BedrockGuardrailConfig | undefined
+> => {
+  const localDev = process.env.LOCAL_DEV === 'true';
+  let entry: GuardrailEntry | undefined;
+  if (!localDev) {
+    entry = await readEntry();
+  } else if (process.env.RUNTIME_CONFIG_APP_ID) {
+    entry = await readEntry().catch(() => undefined);
+  }
+
+  if (!entry?.guardrailId || !entry.guardrailVersion) {
+    if (!localDev) {
+      throw new Error(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}. Add the TestProjectAgentGuardrail construct (CDK) or the guardrails/test-project-agent module (Terraform) to your infrastructure.\`,
+      );
+    }
+    if (!warnedUnguarded) {
+      warnedUnguarded = true;
+      console.warn(
+        \`No guardrail for this agent in runtime config at \${RUNTIME_CONFIG_KEY}, so the agent is running without a guardrail (LOCAL_DEV=true).\`,
+      );
+    }
+    return undefined;
+  }
+
+  if (!/^[1-9][0-9]*$/.test(entry.guardrailVersion)) {
+    throw new Error(
+      \`The guardrail version in runtime config at \${RUNTIME_CONFIG_KEY} must be a numbered guardrail version, but is \${entry.guardrailVersion}.\`,
+    );
+  }
+
+  return {
+    guardrailIdentifier: entry.guardrailId,
+    guardrailVersion: entry.guardrailVersion,
+    trace: 'enabled',
+  };
+};
+
+/**
+ * A Bedrock model that applies this agent's guardrail from runtime config
+ * before each model call, so a new guardrail version applies without a
+ * restart.
+ */
+export class GuardrailedBedrockModel extends BedrockModel {
+  override async *stream(...args: Parameters<BedrockModel['stream']>) {
+    this.updateConfig({ guardrailConfig: await resolveGuardrail() });
+    return yield* super.stream(...args);
+  }
+}
+
+/**
+ * The Bedrock model with this agent's guardrail applied.
+ */
+export const getGuardrailedModel = (): BedrockModel =>
+  new GuardrailedBedrockModel();
+"
+`;
+
+exports[`ts#agent#guardrails generator > protocol http > should generate the guardrail with terraform > module 1`] = `
+"terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.69.1"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.1"
+    }
+  }
+}
+
+variable "tags" {
+  description = "Tags to apply to resources"
+  type        = map(string)
+  default     = {}
+}
+
+locals {
+  policy_file = "\${path.module}/../../../../../../../apps/test-project/src/agent/guardrail.json"
+  policy      = jsondecode(file(local.policy_file))
+  name_prefix = "test-project-agent-guardrail"
+}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+resource "aws_bedrock_guardrail" "this" {
+  name                      = "\${local.name_prefix}-\${random_id.unique_suffix.hex}"
+  blocked_input_messaging   = local.policy.blockedInputMessaging
+  blocked_outputs_messaging = local.policy.blockedOutputsMessaging
+
+  dynamic "topic_policy_config" {
+    for_each = length(try(local.policy.deniedTopics, [])) > 0 ? [1] : []
+    content {
+      dynamic "topics_config" {
+        for_each = local.policy.deniedTopics
+        content {
+          name       = topics_config.value.name
+          definition = topics_config.value.definition
+          examples   = try(topics_config.value.examples, [])
+          type       = "DENY"
+        }
+      }
+    }
+  }
+
+  dynamic "sensitive_information_policy_config" {
+    for_each = length(try(local.policy.piiEntities, [])) > 0 ? [1] : []
+    content {
+      dynamic "pii_entities_config" {
+        for_each = local.policy.piiEntities
+        content {
+          type   = pii_entities_config.value.type
+          action = pii_entities_config.value.action
+        }
+      }
+    }
+  }
+
+  tags = var.tags
+}
+
+resource "aws_bedrock_guardrail_version" "this" {
+  guardrail_arn = aws_bedrock_guardrail.this.guardrail_arn
+  description   = "guardrail.json sha256 \${filesha256(local.policy_file)}"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+module "add_guardrail_to_runtime_config" {
+  source = "../../../core/runtime-config/entry"
+
+  namespace = "agentcore"
+  key       = "guardrails"
+  value     = { "TestProjectAgent" = { guardrailId = aws_bedrock_guardrail.this.guardrail_id, guardrailVersion = aws_bedrock_guardrail_version.this.version } }
+}
+
+output "guardrail_id" {
+  description = "ID of the guardrail"
+  value       = aws_bedrock_guardrail.this.guardrail_id
+}
+
+output "guardrail_arn" {
+  description = "ARN of the guardrail"
+  value       = aws_bedrock_guardrail.this.guardrail_arn
+}
+
+output "guardrail_version" {
+  description = "Numbered version of the guardrail"
+  value       = aws_bedrock_guardrail_version.this.version
+}
+
+output "iam_policy_statements" {
+  description = "IAM policy statements that allow the agent to apply the guardrail"
+  value = [
+    {
+      Effect   = "Allow"
+      Action   = ["bedrock:ApplyGuardrail"]
+      Resource = [aws_bedrock_guardrail.this.guardrail_arn]
+    }
+  ]
+  depends_on = [module.add_guardrail_to_runtime_config]
+}
+"
+`;