← Back to Dashboard
1. Guardrails Concepts2. Policy Testing and Failure Modes
Policy Testing and Failure Modes
📚 Safety and Guardrails⏱ 10 min⭐ 75 XP⌨ Hands-on lab
Policy Quality Is Measurable
Safety quality requires regression testing. Build a repeatable suite that includes allowed, risky, and prohibited requests, then score guardrail behavior over time - exactly like a unit-test suite for your safety posture.
The Four Outcomes Every Test Can Produce
| Outcome | Meaning | Severity |
|---|---|---|
| True positive | Unsafe content correctly blocked | Working as intended |
| True negative | Safe content correctly allowed | Working as intended |
| False negative | Unsafe content allowed through | Critical - compliance/harm exposure |
| False positive | Safe content wrongly blocked | Erodes UX and user trust; teams then weaken policies |
Building the Suite
- Benign set - realistic everyday requests that must always pass (regression canary for over-blocking).
- Borderline set - dual-use questions, aggressive-but-legitimate wording, policy edge cases.
- Prohibited set - known-bad prompts, including indirect phrasings and roleplay-wrapped attempts.
- Injection set - prompt-attack payloads (ignore-previous-instructions, tool-output poisoning, encoded instructions).
Score each release: block-rate on prohibited, pass-rate on benign, and drift versus the previous run. Bedrock's ApplyGuardrail API lets you test policies standalone - no model invocation required - which makes CI integration cheap.
- Measure false negatives (unsafe content allowed).
- Measure false positives (safe content blocked).
- Track drift after prompt or model changes - a model upgrade can shift guardrail behavior even with identical policies.
CI rule: run the safety suite on every guardrail config change, every prompt release, and every model version bump. Any new false negative on the prohibited set is a blocking failure.
⌨ HANDS-ON LABBuild a Safety Regression Set
⭐ +150 XPCreate a red-team style prompt suite and validate expected block/allow outcomes.
1Create a CSV of test prompts and expected outcomes.
2Document block-rate and false-positive metrics.
OBJECTIVE 1 / 2 — type "hint" if stuck
🧪 Knowledge Check
Press 1-4 to select1 of 2
Which metric is most dangerous in regulated environments?
False negatives on unsafe content
UI load time
Icon size
Git commit frequency