[FEATURE] Claude apps gateway: Support for Bedrock Guardrails headers

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

I work with multiple enterprise customers who deploy Claude apps gateway and would like to use Bedrock Guardrails but putting ANTHROPIC_CUSTOM_HEADERS in a managed.policies[].cli.env block just pushes that env var down to the Claude Code client, where it has the exact same problem as setting it locally: those headers are added to the request the client sends to the gateway, and the gateway strips them when it re-originates its own call to Bedrock.

Looking at the gateway protocol reference: ANTHROPIC_CUSTOM_HEADERS values do arrive at the gateway as headers on the client's request to the gateway. But the Bedrock upstream section shows the gateway builds its own signed InvokeModel call to Bedrock from region, auth, and base_url there's no documented field that copies arbitrary inbound client headers onto that outbound Bedrock call. The only fields the docs describe crossing that Anthropic→Bedrock translation boundary are the anthropic_beta/anthropic_version body fields (per the format-translation table), not headers generally, and definitely not a guardrail header.

Proposed Solution

Forwarding the ANTHROPIC_CUSTOM_HEADERS sent by the client when the gateway builds its own signed InvokeModel call to Bedrock

Alternative Solutions

_No response_

Priority

Critical - Blocking my work

Feature Category

Configuration and settings

Use Case Example

_No response_

Additional Context

_No response_