Generative AI creates new content, so it brings its own risks: harmful, offensive or misleading output. Microsoft organises the protections into layers, each owned by a different part of the solution.
The four mitigation layers
Think of the layers as a stack, from the model at the bottom to the user interface at the top. A well-designed solution uses all of them rather than relying on one. Figure 1.1 shows the four layers as a stack.
| Mitigation layer | What it is |
|---|---|
| Model | Choosing (and fine-tuning) the model |
| Safety system | Platform guardrails (content filters) that classify and block harmful prompts and completions; abuse monitoring |
| Metaprompt and grounding | System message plus grounding data in the prompt to steer the model away from harmful output |
| User experience | UI design, disclosure and constraints for users |
Common trap: The safety system layer is sometimes described as “system inputs and context”. That describes the metaprompt and grounding layer: system messages plus grounding. The safety system layer is the platform’s filtering and monitoring.
Guardrails (content filtering)
Guardrails are the main safety system control you configure yourself. They inspect what goes into and comes out of a model and act on harmful content.
- Guardrails (previously called content filtering) in Azure OpenAI in Foundry Models run on both prompts and completions, including generated images.
- They classify content in four harm categories: hate and fairness, sexual, violence and self-harm, each by severity (safe, low, medium or high), and then block or annotate it.
- Filtering applies to all Foundry Models sold by Azure, whichever you deploy, except audio transcription models such as Whisper.
- The strongest protection for image generation is to block at the lowest severity threshold on both input and output.
Common trap: A system prompt that tells the model to avoid harmful content steers it but guarantees nothing, and fine-tuning or changing the model is not a safety control. For guaranteed blocking, configure the guardrail thresholds.
Abuse monitoring
Abuse monitoring works at a different level from guardrails: it looks at behaviour over time rather than at a single response.
- Abuse monitoring looks for patterns of misuse across a customer’s traffic for Microsoft review.
- It doesn’t classify or block individual responses; that is the guardrails’ job.
Azure AI Content Safety
The same detection technology is also available as a standalone service you can call from any application.
- Azure AI Content Safety (now part of Foundry Tools, formerly Azure AI services) detects hate, sexual, violence and self-harm content in text and images. The same technology powers the Foundry guardrails.
- Azure Language’s PII detection finds personal data such as names and phone numbers; it is not harmful-content moderation.
Common trap: PII detection is not a content moderation tool. To find harmful content (hate, sexual, violence, self-harm), use Azure AI Content Safety or guardrails.
You don’t need your own model to be responsible
It’s a common misconception that responsible AI requires training your own model. Responsible AI with pretrained models is achieved through guardrails, grounding, evaluation, human oversight and transparency to users.