Guardrails are the built-in, configurable safety layer that sits between users, models and tools in Microsoft Foundry. They decide what is checked, where in a run it is checked, and what happens when something is detected.
Harm filtering and severity thresholds
- Content filters (guardrails in Microsoft Foundry) classify prompts and completions for hate, sexual, violence and self-harm by severity, and block content at or above the deployment’s severity threshold. They run on Azure AI Content Safety.
- Frequency penalty and temperature don’t filter anything; they only change how tokens are sampled.
- PII guardrail (or Azure Language PII detection) annotates, redacts or blocks names, email addresses and phone numbers in retrieved content and output. It’s the data-leakage control when a customer document has been added to a knowledge store by mistake.
Intervention points and actions for agents
- Agent guardrail intervention points: user input, tool call, tool response and output. Cover all four with Block to stop harmful content anywhere in the run.
- Annotate only flags content without stopping it, and agents support only annotate-and-block. Figure 4.1 marks where each point sits in a run.
Choosing the right control
Each control catches a specific class of problem; none of them covers everything, so production solutions layer several.
| Control | Catches | Doesn’t catch |
|---|---|---|
| Prompt Shields for user prompts (was jailbreak risk detection) | Direct attacks in the user’s own input: rule changes, role-play personas, conversation mockups, encoding tricks | Instructions in documents or images; unsafe imagery |
| Prompt Shields for documents | Indirect attacks in third-party content: grounding data, OCR text, tool responses | Unsafe imagery |
| Spotlighting (preview, Prompt Shields sub-feature) | Marks document content (base64) as lower trust than system and user prompts | — |
| Text and image moderation | Hate, sexual, violence, self-harm by severity | Prompt injection |
| Protected material detection | Known copyrighted text in output (lyrics, articles, recipes, web content) and code from GitHub repos | Harm categories, injection |
| Custom blocklists | Exact listed terms | Unknown phrasing |
| PII detection | Personal data | Injection, harm |
- Abuse monitoring is a separate, service-level process: it detects patterns of misuse across a customer’s traffic for Microsoft to review.
Common trap: Choosing abuse monitoring to block hate speech in model output - abuse monitoring detects patterns of misuse for Microsoft to review; it’s content filters (guardrails) that block individual responses.