What is the difference between ENABLED and ENABLED_FULL for trace in Guardrail Configuration?

When configuring trace behavior in Amazon Bedrock Guardrails, there are three options: enabled, disabled, and enabled_full. While the documentation doesn't explicitly detail the differences between enabled and enabled_full, we can understand their general purposes:

When trace is set to "enabled", the API response includes basic trace information in the amazon-bedrock-trace field. This provides insights into how the guardrail evaluated the input and output, including detected violations of content policies, denied topics, or other configured filters. The trace contains information about content that was blocked by the guardrail.

The enabled_full option likely provides more comprehensive trace data compared to the standard enabled setting, potentially including additional details about the guardrail's decision-making process or more verbose information about all evaluations performed.

In the response format, when a guardrail is enabled with tracing, you'll receive:

• amazon-bedrock-guardrailAction: Indicates whether the guardrail "INTERVENED" or "NONE"
• amazon-bedrock-trace: Contains a list of traces with information about blocked content

The trace information includes:

• modelOutput: Contains the outputs from the model that were blocked
• input: Details about the guardrail's assessment of the prompt, including topicPolicy information with names of violated topic policies, their types, and actions taken

While the exact difference in response format between enabled and enabled_full isn't specified in the available documentation, enabled_full presumably provides more extensive trace data for more detailed analysis and debugging of guardrail behavior.
Sources
Safeguard your generative AI workloads from prompt injections | AWS Security Blog
GuardrailConfiguration - Amazon Bedrock
Test a guardrail - Amazon Bedrock
GuardrailStreamConfiguration - Amazon Bedrock

Hello,

In Amazon Bedrock's GuardrailConfiguration, the trace field values ENABLED and ENABLED_FULL differ in the level of detail provided in the response:

ENABLED:

• Provides basic tracing information
• Shows whether guardrails were triggered
• Includes high-level evaluation results
• Returns a simplified trace output

Example Response Format:

{
  "trace": {
    "guardrailsEvaluated": true,
    "guardrailsTriggered": ["rule1", "rule2"],
    "evaluationResult": "allowed"
  }
}

ENABLED_FULL:

• Provides comprehensive tracing information
• Shows detailed evaluation steps
• Includes complete rule matching information
• Returns the full trace output with all intermediate steps
• Shows exactly how each guardrail rule was evaluated
• Includes more detailed context about why specific rules were triggered

Example Response Format:

{
  "trace": {
    "guardrailsEvaluated": true,
    "guardrailsTriggered": ["rule1", "rule2"],
    "evaluationResult": "allowed",
    "evaluationSteps": [
      {
        "ruleId": "rule1",
        "evaluation": "detailed_matching_info",
        "context": "full_context_information"
      },
      {
        "ruleId": "rule2",
        "evaluation": "detailed_matching_info",
        "context": "full_context_information"
      }
    ],
    "intermediateResults": [
      // Detailed evaluation steps
    ]
  }
}

ENABLED_FULL is useful for debugging and understanding exactly how guardrails are being applied, while ENABLED provides a simpler overview suitable for basic monitoring.

I hope this is helpful. If yes, please upvote/accept my answer. Thank you.