{"version":"2.1.314","anchor":"gateway-guardrail-trace-rows","canonical_anchor":"bedrock-gateway-can-send-trace-header","heading":"Bedrock guardrail tracing in the gateway","tier":"use","area":"Gateway Proxy","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314\/e\/gateway-guardrail-trace-rows","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314","markdown":"### Bedrock guardrail tracing in the gateway\n\nA new Bedrock `guardrail_trace` option requests guardrail traces and records which filters fired, with trace rows from the gateway proxy\n\n**What**\n\nAmazon Bedrock guardrails are filters Bedrock can apply to requests and replies. The gateway, which passes Claude Code's requests on to upstream providers, can now ask Bedrock to report what its guardrails did:\n\n- The gateway config has a new Bedrock boolean, `guardrail_trace`, which sets `guardrailTrace`.\n\n- When it is on, Bedrock requests add the header `X-Amzn-Bedrock-Trace: ENABLED`. The guardrail id and version headers are now merged with it instead of being the only headers.\n\n- Responses that carry `amazon-bedrock-trace` produce a `guardrail.trace` event listing the filters that fired, and the trace field is removed from the event.\n\n- The gateway proxy can attach a guardrail trace row (request_id, sub, email, upstream) to responses and streams when the upstream has `guardrailTrace` set.\n\n- The gateway config also gains a per-upstream `groups` list, and desktop overlay validation now reports deprecations with their support-end dates.\n\n**Why**\n\nIf you run Bedrock behind the gateway with guardrails, you can now see which filters acted on a request and who sent it, which helps when a guardrail blocks something unexpectedly.\n\n- Area: Gateway Proxy\n- Names: `guardrailTrace`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: no"}