This rule detects updates to an Amazon Bedrock guardrail by monitoring AWS CloudTrail events. Specifically, it looks for eventName = UpdateGuardrail and eventSource = bedrock.amazonaws.com. Such updates may indicate attempts to weaken model safety controls or permit unsafe or unauthorized model responses. The rule is triggered when a corresponding CloudTrail record matches the selection criteria, signaling a potential attempt to modify guardrails that enforce safeguarding behavior. It is labeled with medium severity. False positives include legitimate guardrail updates performed by authorized identities, e.g., as part of approved security or model governance processes. Operators should corroborate updates with change management data (e.g., active IAM role, source IP, MFA status, and documented approvals) before alerting or taking action. Tuning guidance: correlate with known change windows, verify the principal and session context, and optionally restrict alerts to unusual principals, rare times, or specific Bedrock guardrails to reduce noise. This rule relies on CloudTrail logs sourced from Bedrock API activity and serves as a guardrail-change monitoring signal rather than a direct indicator of compromise.