Azure AI Foundry Content Safety: Configuring Guardrails for Public-Facing Assistants

Public-facing conversational assistants carry a different risk profile from internal productivity tools. When a resident, citizen, or aged care client interacts with an assistant, the organisation deploying it inherits a duty of care that extends to the language the model produces, the information it discloses, and the ways in which malicious users may attempt to manipulate it. Azure AI Foundry provides a layered set of content safety capabilities that allow teams to define acceptable behaviour before an assistant is exposed to the public, rather than discovering problems after they reach a vulnerable audience.

For WA Government agencies and aged care providers, these guardrails are not merely a technical preference. They support accountability obligations, reduce the likelihood of harmful or misleading responses, and give governance teams defensible evidence that reasonable safeguards were configured. This article explains the core safety layers available in Azure AI Foundry and offers practical guidance on tuning them for assistants that serve the public.

The content safety layers in Azure AI Foundry

Azure AI Foundry draws on Azure AI Content Safety, which evaluates both user input and model output across four harm categories: hate, sexual content, violence, and self-harm. Each category is assessed against configurable severity thresholds, so a team can decide how tolerant or restrictive the assistant should be for a given audience. For a public service or aged care context, stricter thresholds are usually appropriate because the audience may include people in distress, older adults, or individuals with limited digital literacy.

Beyond these harm categories, Foundry includes Prompt Shields to detect attempts to subvert the system through direct jailbreak instructions and indirect prompt injection hidden in retrieved documents. It also offers groundedness detection, which flags responses that are not supported by the source material supplied to the model. Understanding how these components interact is essential, because a well-tuned assistant rarely relies on a single control. Instead, it combines input filtering, output filtering, injection detection, and grounding checks into a defence that degrades gracefully when any one layer is challenged.

Tuning content filters and severity thresholds

Configuring content filters begins with mapping the assistant's purpose to the categories and severity levels that matter most for its audience. An assistant that answers questions about aged care services, for example, will legitimately need to discuss sensitive topics such as health conditions or end of life planning, so blanket high-sensitivity filtering can block useful and compassionate responses. The goal is to calibrate thresholds so that genuinely harmful content is intercepted while legitimate, context-appropriate discussion is permitted. This requires testing with realistic prompts drawn from the actual service domain rather than generic examples.

Separating input filtering from output filtering gives teams finer control. Input filtering stops abusive or manipulative prompts before they consume model capacity, while output filtering provides a final check on what the assistant returns to the user. For self-harm in particular, agencies should pair detection with a deliberate response pattern, such as surfacing crisis support information rather than simply blocking the message, because a silent refusal can leave a vulnerable person without help. Documenting the chosen thresholds and the reasoning behind them also supports later review and audit.

Jailbreak detection, prompt shields and grounding

Prompt Shields address a class of attacks that content filters alone do not catch. Direct jailbreak attempts try to persuade the model to ignore its instructions, while indirect injection embeds hostile instructions inside content the assistant retrieves, such as a web page or an uploaded document. For assistants that use retrieval augmented generation over agency knowledge bases, indirect injection is a realistic threat, because an attacker who can influence a source document may be able to influence the assistant's behaviour. Enabling Prompt Shields across both user prompts and grounding documents reduces this exposure considerably.

Groundedness detection complements these shields by comparing the assistant's answer against the supplied sources and flagging claims that are not supported. This matters for duty of care because an ungrounded response, often described as a hallucination, can present incorrect eligibility rules, service details, or health guidance with unwarranted confidence. Combining grounding checks with clear citations and a conservative fallback, where the assistant declines to answer rather than guess, helps ensure that residents and citizens receive information the organisation can stand behind. These controls should be treated as adjustable settings that are revisited as the knowledge base and usage patterns evolve.

Governance, testing and ongoing assurance

Technical configuration is only part of a responsible deployment. Before an assistant goes live, teams should conduct structured red teaming that deliberately probes the filters, attempts known jailbreak techniques, and tests edge cases specific to the service domain. Logging the outcomes, together with the content safety decisions made during normal operation, creates an evidence trail that governance and risk functions can review against their obligations. This aligns with the expectation, reflected in Australian guidance on secure and responsible AI, that organisations monitor and evaluate systems throughout their lifecycle.

Guardrails also need owners and a review cadence, because model updates, new content sources, and changing user behaviour can all shift the risk picture over time. Assigning responsibility for reviewing filter thresholds, investigating blocked interactions, and updating the assistant's instructions keeps the safeguards current rather than static. For WA Government and aged care providers, this ongoing assurance is where configured guardrails translate into sustained protection for the people the service exists to help, and into confidence that the deployment remains defensible as it scales.

References

• Azure AI Content Safety overview, Microsoft Learn
• Prompt Shields, Microsoft Learn
• Artificial intelligence guidance, Australian Cyber Security Centre