Archer turns written regulations into Amazon Bedrock guardrails that block prompts before inference

Archer has kept itself out of the runtime ^[10]. The guardrails it drafts are native Amazon Bedrock guardrails deployed inside each customer's own AWS account ^[2]. Models running outside Bedrock can adopt the same controls through Amazon's ApplyGuardrail API ^[10]. No proxy sits in the inference path ^[10]. If the connection to Archer drops, the guardrails keep enforcing in their last deployed state ^[15].

So a buyer is paying Archer for the work that happens before a guardrail exists. The company says the document library behind its controls is maintained by legal experts ^[7], and that it has trained 492 purpose-built models since 2017 ^[12]. "A guardrail is only as good as the obligation behind it. Someone must capture the regulation, identify the requirement, map it to a control and keep that mapping current as the rule changes," Kayvan Alikhani, Archer's chief product and technology officer, said ^[18]. "Our customers do not have to build that chain. We already did," he said ^[19].

Archer's case for new spending rests on a distinction it draws itself. It argues that this year's AI governance debate has centred on access controls such as identity and zero trust, which decide who may reach a system and not whether a given action is permitted ^[4]. According to the company, a properly authenticated user or agent can still submit a prompt that breaches a regulation nobody has translated into a control ^[5]. Risk, compliance and security teams already own the relevant policies. Until now they have had no way to apply them when a prompt reaches a model, Archer says ^[22]. The product is available now ^[17]. The launch report does not include a price or a customer count, so nothing yet shows a compliance budget moving.

Archer could sell the product as an add-on to the GRC licences customers already hold. In that case compliance money gets relabelled more than moved. Firms whose models mostly sit outside Bedrock could treat the ApplyGuardrail integration ^[10] as next year's project. Or the obligation mapping could become the thing regulated buyers pay for, with Bedrock simply the place it runs.

I think the third outcome is the likelier one for firms that answer to examiners. The audit trail runs from source to obligation to control to guardrail to violation, and firms can present it to examiners on request ^[11]. Building that chain in-house means doing the capture-and-map work Alikhani describes for every rule a firm is bound by ^[18], across data categories from API keys to cardholder data ^[21]. The view is wrong if Archer's first public pricing puts the product inside existing licences at no separate charge, because compliance budgets would then have stayed where they were.