Study AIP-C01 safety controls for harmful prompts, jailbreaks, hallucination reduction, structured outputs, and defense-in-depth filtering.
AIP-C01 safety questions are about where to place the control and how many layers are needed. AWS is usually not asking for one “best guardrail feature.” It is asking how to prevent harmful inputs, constrain harmful outputs, reduce hallucinations, and make misuse harder across the whole request path.
The current AIP-C01 domain page points to five recurring safety areas:
That means this task is broader than moderation alone.
| Requirement | Strongest first fit | Why |
|---|---|---|
| Need to block harmful or policy-violating prompts | Input filters, guardrails, or moderation workflow | Stop unsafe input before it reaches the FM |
| Need to prevent unsafe model outputs | Output filters, Bedrock guardrails, or policy checks | Output control belongs after generation too |
| Need to reduce hallucinations in factual answers | Grounding, fact verification, structured outputs, or confidence checks | Hallucination reduction is not the same as toxicity filtering |
| Need deterministic result shape | JSON Schema or constrained output pattern | Format control can reduce unsafe or unusable responses |
| Need stronger protection against jailbreaks or injected instructions | Layered defenses across input, retrieval, tool use, and output | One filter layer is usually not enough |
Many weak answers collapse them together.
Input controls are strongest when the risk is:
Output controls are strongest when the risk is:
The strongest architecture often uses both.
AWS explicitly includes accuracy verification systems. That means you should separate:
If the problem is “the system sounds confident but invents facts,” the stronger answer is often:
not only a generic moderation layer.
AIP-C01 increasingly rewards layered safety patterns:
If a question mentions prompt injection plus unsafe tools plus private data, a single control is usually incomplete.
If retrieved content or user content can tell the model to ignore prior instructions, the real problem is broader than prompt quality. Strong answers usually add:
When the system is unsafe, ask separately: what enters, what the model sees, what it can do, and what leaves.