Domain 1 of 5 · Chapter 4 of 4

Responsible AI for Generative and Agentic Systems

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing AI-103 premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • The anatomy of a guardrail and its controls
  • Where the scan happens: four intervention points
  • Severity thresholds and the two response actions
  • Prompt Shields for user prompt and document attacks
  • Groundedness detection and correction
  • Protected material detection for text and code
  • Custom blocklists for your own vocabulary
  • Evaluators: system, process, and safety
  • Where the evaluation dataset comes from
  • The AI red teaming agent
  • Constraining what an agent may call
  • Tool governance outside the agent definition
  • Auditing with traces, provenance, and approvals
  • Exam-pattern recognition

The four responsible-AI control families for generative and agentic systems

Decision axisGuardrails and controlsEvaluation and red teamingTool-access governanceAuditing and traces
Question it answersIs this specific content allowed through right now?How often does the system fail, and at which step?What is this agent permitted to do at all?What record exists of what happened?
When it runsInline on every request, at the chosen intervention pointsOffline against a dataset before release, or on sampled traffic after itAt agent configuration, then again at each proposed tool callContinuously, as the run emits spans
What it inspectsUser input, tool call, tool response, or output textQuery, response, tool calls, and tool definitions for a whole trajectoryThe tool list, and the name and arguments of one invocationPrompts, completions, tool arguments, and tool results
What it producesDetected and filtered annotations, or a blocked requestPass or fail labels, severity scores, defect rate, Attack Success RateAn approval request to answer, or a tool the agent cannot seeQueryable spans under your telemetry retention policy
Enforces or reportsEnforces, when the action is Annotate and blockReports only; it changes no runtime behavior on its ownEnforces, by removing capability or pausing the runReports only, and only what was instrumented and not redacted
What it cannot catchWhether the agent chose the right action overallA request in flight right nowHarmful wording inside the arguments of an allowed toolAnything the design chose not to capture

Decision tree

Must this stop somethingas it happens?noyesMeasure the failure,or record what happened?Is the risk in the content,or in the action?measurerecordcontentactionEvaluation andred teamingmeasures, never blocksAuditing and tracesredact at the sourcelog the approvalsGuardrails and controls:where does it enter?Tool-accessgovernanceallowlist, approvalon the way inon the way outPrompt Shieldsuser input for typedattacks, tool responsefor document attacksOutput-side controlsprotected material,custom blocklists
Cheat sheet

Cheat sheet

  • A guardrail is a named collection of controls, and each control names a risk, its intervention points, and the response action
  • Four intervention points exist, but models can only be scanned at user input and output; tool call and tool response are agent-only
  • Models can annotate without blocking, but agents support only annotate-and-block
  • An agent's assigned guardrail fully overrides its model deployment's guardrail rather than layering on top of it
  • For hate, sexual, self-harm, and violence, the severity threshold sets how much is flagged, with Low being the least restrictive setting
  • The user prompt attack shield covers text the user types; the document attack shield covers hidden instructions in third-party content
  • Spotlighting base-64 encodes document content so the model treats it as lower trust, at the cost of extra tokens
  • Prompt Shields returns detected and filtered flags per request, which is what lets annotate mode observe attacks without blocking
  • Prompt Shields is a probabilistic filter layered on top of prompt design, not a replacement for structurally separating data from instructions
  • Groundedness detection runs in non-reasoning or reasoning mode and must be told the task type and domain
  • The groundedness correction feature rewrites ungrounded content to match the grounding sources instead of only flagging it
  • Groundedness and spotlighting are preview risks applicable to models but not to agents, so those controls silently do nothing on an agent
  • Protected material detection is an output-side control with separate text and code variants
  • Custom blocklists do exact term matching for use-case-specific wording and can be attached as an input filter, an output filter, or both
  • Foundry's agent evaluators each isolate a different step of agentic failure rather than scoring the final answer
  • Risk and safety evaluators cover agentic failure modes beyond the four harm categories
  • The AI red teaming agent simulates complex attacks with Microsoft's PyRIT framework before deployment
  • The evaluation SDK's simulators produce the evaluation dataset when there is no production traffic and no human-labeled ground truth yet
  • Setting require_approval to always makes the run emit an approval request that your application must answer before the tool call proceeds
  • The allowed_tools list constrains which of an MCP server's tools an agent may call at all
  • Runtime tool approval governs what a deployed agent may do, not whether a configuration change may be released
  • Trace telemetry can capture user inputs, model outputs, and tool arguments and results, so redaction and retention policy are part of the design
  • Tool access is governed outside the agent definition through an AI gateway and Azure Policy

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. Guardrails and controls overview in Microsoft Foundry
  2. How to configure guardrails and controls in Microsoft Foundry
  3. Intervention points concepts in Microsoft Foundry
  4. Prompt Shields in Microsoft Foundry
  5. Configure content filters in Microsoft Foundry
  6. Groundedness detection in Azure AI Content Safety
  7. Protected material detection filter
  8. How to use block lists in Microsoft Foundry models
  9. Agent evaluators for generative AI
  10. Risk and safety evaluators for generative AI
  11. Generate synthetic and simulated data for evaluation
  12. How to configure network isolation for Microsoft Foundry
  13. AI Red Teaming Agent in Microsoft Foundry
  14. Connect to MCP server endpoints for agents
  15. Tool best practices for Microsoft Foundry Agent Service
  16. Govern MCP tools by using an AI gateway
  17. Agent tracing in Microsoft Foundry
  18. Microsoft Foundry tracing and data handling