What Happened
On October 23, 2026, Amazon Bedrock added domain filtering and optional user-location controls to the web_search tool in OpenAI Responses API requests. Applications can specify up to 100 allowed_domains or up to 100 blocked_domains to influence which websites ground a response. Location controls can help surface geographically relevant information, such as regional availability or local services. The controls are available in supported Web Search Regions: US East (N. Virginia and Ohio), US West (Oregon), and AWS GovCloud (US-West). No version number was specified. [1]
Why It Matters to Businesses
These controls give teams a way to narrow web grounding for applications that depend on approved sources or regional context. A procurement assistant, for example, could favor designated supplier domains; a service assistant could request results relevant to a user’s location. Neither setting makes a retrieved page accurate or turns web search into an authorization boundary.
Kimbodo Engineering Perspective
Domain filtering is most useful as an application policy, not a prompt the user can change. An allowlist offers tighter source control but may omit useful information; a blocklist preserves broader coverage but is weaker when only approved sources should be used. Location improves relevance, but applications should not treat it as proof of a user’s residence or eligibility.
How We Would Implement It
- Define permitted domains and location granularity for each use case, with a fallback when approved sources do not answer the question.
- Set allowed_domains or blocked_domains server-side in Bedrock OpenAI Responses API requests; validate entries and enforce the 100-domain limit. [1]
- Pass user location only when needed and appropriate, then test results across the supported regions and representative local queries.
- Log the applied search policy and returned citations so teams can investigate missing, stale, or unsuitable sources.
Risks, Costs and Security
Domain controls can reduce exposure to unwanted websites, but they do not verify page content or prevent prompt injection in retrieved material. Keep sensitive information out of search queries, minimize stored location data, and validate consequential claims before acting on them. Measure any change in search volume, latency, and spend during rollout; the announcement does not specify pricing changes. [1]
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
