A public-health GenAI stack wants layered misuse protection beyond a single filter. Which architecture best reflects defense-in-depth safety?

A public-health GenAI stack that wants layered misuse protection beyond a single filter should implement defense-in-depth: combine Amazon Comprehend pre-filters, Amazon Bedrock Guardrails, and Lambda post-checks so unsafe content is screened at multiple stages. Pre-filters catch obvious toxic or unsafe inputs early, Guardrails enforce managed policy during FM invocation, and post-checks inspect generations before clinicians or the public see them. Complementary controls reduce the chance that a bypass of one stage becomes a patient-facing incident.

Using a single optional keyword blocklist only on holidays and disable it otherwise fails by concept: intermittent brittle blocklists are not continuous protection and are easy to evade. Depending exclusively on residents to self-report unsafe answers days later fails because harm may already have occurred and detection lag is unacceptable for public health. Removing all classifiers and trusting an unmonitored foundation model with no wrappers fails Responsible AI—base models are not municipal policy engines.

Exam caveat: defense-in-depth is an architecture principle—name and monitor each layer rather than assuming “security exists somewhere.” Silent failures in a post-check are as dangerous as having no post-check. Tune layers for medical misinformation and unsafe advice categories relevant to public health, not only generic toxicity, and assign owners for alerts and update cadence.

Operational check: run an approved misuse suite through the public-health assistant and confirm blocks at Comprehend pre-filter, Bedrock Guardrails, and/or Lambda post-check stages; disable one layer in a test environment and show residual risk caught by another; verify holiday-only blocklist mode is not accepted as production architecture.