Claude Code 2.1.281 adds Bedrock guardrails to its gateway

The Claude apps gateway can now call Amazon Bedrock under a borrowed identity. It assumes an IAM role through STS, in another AWS account if needed, and can open one session per developer. That feature and a per-request Bedrock guardrail head version 2.1.281, according to the release notes on Github. Most of the rest of the release is repairs.

At a glance

• Teams running the Claude apps gateway get four new controls: Bedrock guardrails, STS role assumption, fixed telemetry labels, and support for newer Claude Desktop policy keys such as disableBypassPermissionsMode.
• A guardrail entry takes an id and a version and applies to every request sent through a Bedrock upstream, but the gateway expects it on all Bedrock upstreams or on none.
• The new "attribution": false setting hides all commit and PR attribution. Older CLI versions skip any settings file that contains it, so shared files should keep the object form.

Every Bedrock request through the gateway can now pass a guardrail

You give the guardrail setting an Amazon Bedrock guardrail's id and version. The gateway then applies that guardrail to every request it sends through the upstream. The release notes add one rule: set it on all Bedrock upstreams or on none of them.

The second addition is assume_role. With it, the gateway assumes an IAM role through AWS STS and calls Bedrock as that role. The role can live in another AWS account, and you can have the gateway open one session per developer.

Two smaller items round out the admin side. telemetry.resource_attributes puts fixed labels on the telemetry from Claude Desktop and /login sessions. Desktop policy blocks now accept newer Claude Desktop keys, including blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode. The gateway also refuses to start if a managedMcpServers entry's envHelper path begins with \??\ or /??/, because current Claude Desktop refuses to run paths in that form.

What does it mean for the gateway to assume a role?

In AWS, a role is a set of permissions that no one holds permanently. A service asks STS, the Security Token Service, for temporary credentials to act as that role, uses them, and they expire. A hotel key card works much the same way: the front desk issues it for your stay, and it opens only the rooms on your booking.

For the gateway, this means Bedrock access comes from the role, and the role can belong to a different AWS account than the gateway. With the per-developer option, each developer's calls run in their own STS session. Guardrails work at the Bedrock end: Bedrock checks each request against the guardrail version you pinned.

Resumed sessions stop re-sending changed turns and breaking the prompt cache

A large group of fixes deals with resuming sessions. Resumed sessions could re-send earlier turns in a changed form, such as a parallel tool-call turn, and that could make the API drop the conversation's earlier reasoning. A session resumed after a restart during a pending permission prompt sent a different history than before, which broke the prompt cache from that point on.

Resuming a very large session sometimes brought back only its last few messages. When a session ended during a tool call, Claude now sees that call on resume and is told its outcome is unknown. A manual resume no longer adds a hidden "Continue" message. Behind a proxy that closes the stream cleanly, cut-off responses are now flagged instead of shown as complete, and duplicated stream events no longer make tool calls run twice.

rm -rf "$(pwd)" now asks first, even in auto mode

A recursive rm whose only target is command-substitution output, such as rm -rf "$(pwd)", used to run without a prompt in auto mode and under --dangerously-skip-permissions. It now asks even when a Bash allow rule covers it, unless CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1 is set. The dangerous-rm check also flags a shell variable followed by a top-level directory name, a variable derived from the working directory, and a backslash-only target.

Unattended sessions now have a timeout. In those two modes, the dangerous rm prompt waits 2 minutes, then denies the command with a hint for rewriting it, so the session keeps going. CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 turns the timeout off. Where auto mode's classifier review runs server-side, read-only and sandboxed shell commands now also wait for the review and are blocked if it flags them.

The release notes also point out their own compatibility traps. Older CLI versions skip any settings file that holds "attribution": false, and self-hosted runners now pass system prompts as files, so a hook that appends --system-prompt or --append-system-prompt must switch to the -file variants. In our view, a single new key that makes older versions skip the whole file is a sharp edge for teams on mixed versions.

Before sharing that settings file

The notes don't say which older CLI versions skip a file containing "attribution": false. Until you know everyone on your team runs 2.1.281, the object form is the safe choice. MCP URL-mode elicitation lets a server ask Claude Code to open a browser-based flow, but it works only on 2026-07-28 protocol connections. The notes don't say when servers will start supporting it.