Responsible AI in Practice: Guardrails, Safety Evaluations and Agent Governance (AI-103)

On AI-901 you learned the six responsible AI principles. AI-103 asks how to implement them: configure guardrails, measure safety, keep an audit trail, and control what agents are allowed to do. This lesson covers the Implement responsible AI across generative AI and agentic systems skill group.

Guardrails and content filters

Every model deployment in Foundry is protected by guardrails (content filters) powered by Azure AI Content Safety. They check both the input (prompt) and the output (completion):

You create a custom guardrail policy, choose thresholds and which checks block versus annotate, then assign it to deployments or agents. Lower thresholds block more; a children's education app needs stricter settings than an internal security research tool.

When a filter blocks a prompt, the API returns an error with the category. When it blocks a completion, the response stops with a content-filter finish reason. Your app should show a polite message, not a stack trace.

Measuring safety and quality

Filters stop bad content at runtime; evaluations tell you how often it happens before you ship. Foundry provides:

• Risk and safety evaluators: hateful and unfair, sexual, violent and self-harm content, protected material, indirect attack vulnerability, code vulnerability
• Quality evaluators: groundedness, relevance, coherence, fluency, and agent evaluators such as tool call accuracy and task adherence
• AI red teaming agent: automatically generates adversarial prompts to probe your app, and reports an attack success rate

Run them on a test dataset during development, in CI/CD as a release gate, and continuously on sampled production traffic. The evaluation lesson shows the code.

Explanation tooling supports transparency: show citations for grounded answers, expose which tools an agent used, and log the evaluator's reasoning next to each score so people can understand why an answer was flagged.

Auditing: traces, provenance and approvals

For accountability you need to answer "why did the system do that?" weeks later:

• Trace logging: OpenTelemetry traces of every request: prompts, model and version, retrieved documents, tool calls, outputs, tokens and timings. Store them in Application Insights with retention that matches your policy, and protect them, since they can contain personal data.
• Provenance metadata: record the sources behind each answer (document IDs, URLs, index version), the prompt or agent version, and the model deployment. For generated images and video, content credentials (C2PA) mark media as AI-generated.
• Approval workflows: high-impact actions wait for a person to approve, and the approval (who, when, what) is logged.

Governing agent behaviour

Agents take actions, so governance goes beyond content filtering:

• Oversight modes: fully autonomous, human-in-the-loop (approve each risky action), or human-on-the-loop (monitor and intervene). Match the mode to the risk.
• Constraints: clear instructions on scope ("only handle billing questions"), maximum turns, time and token budgets, and allowed data sources
• Tool-access controls: give each agent only the tools it needs. For MCP and other tools, require approval before calls (for example require_approval on an MCP tool) or allow only a list of named tools.
• Identity: each agent runs with its own identity and least privilege RBAC, so a compromised agent can't reach everything
• Inventory and policy: keep track of which agents exist, who owns them and what they can access, and use Azure Policy to enforce settings such as approved models and disabled key auth

A worked example

A customer-service agent can look up orders and issue refunds.

1. Guardrails with Prompt Shields on, because it reads customer emails (indirect attacks)
2. Tools: get_order (read-only, automatic) and issue_refund (approval required above $100)
3. Agent identity with read access to orders and a narrowly scoped refund API
4. Safety and quality evaluations in CI; red teaming before launch
5. Traces with order IDs and refund approvals for audit

Key takeaways

• Guardrails = harm categories with thresholds + Prompt Shields (jailbreak and indirect) + protected material + groundedness + blocklists, on input and output.
• Measure with safety and quality evaluators and red teaming, in CI and continuously.
• Audit with traces, provenance metadata and logged approvals.
• Govern agents with oversight modes, constraints, least-privilege identities and tool approvals.

Next lesson: build generative apps with the Foundry SDK.