Detects CloudTrail events for AWS Bedrock DeleteGuardrail, the API call used to remove a guardrail that enforces safety controls on Bedrock models. The rule matches CloudTrail records where eventName equals 'DeleteGuardrail' and eventSource equals 'bedrock.amazonaws.com'. Deleting a guardrail could enable unsafe or unauthorized model responses by removing safety constraints. Because guardrail deletions can be legitimate in change-management contexts, the rule flags this as a potential indicator rather than a definitive breach, and notes a likely false positive: legitimate guardrail deletion by authorized identities. The detection is categorized as medium severity and is labeled experimental. It is primarily a Cloud/AWS-facing rule, leveraging CloudTrail logs as the data source. Operational considerations include correlating with IAM identity, MFA status, source IP, time of deletion, and sensitivity of the guardrail deleted. Recommendations: restrict DeleteGuardrail permissions to only trusted admins, enable CloudTrail data events for Bedrock guardrail changes, require approvals for such changes, alert on patterns of repeated or anomalous deletions, and maintain a guardrail backup or change-log.