AI Agent Orchestration Platform  ·  View 21 of 32  ·  4 · Runtime

Safety Guardrails

Six threat classes, and what the platform does about each at detect, decide, act and record.

Editable source SVG draw.io All views
Detect Decide Act Record Prompt injection Prompt Shields Severity threshold Strip and refuse Guardrail event Sensitive data egress PII and label scan Classification rule Redact or reroute Audit with hash Unsafe tool use Argument inspection Permission and blast Block or escalate Audit ledger Ungrounded output Groundedness check Citation coverage Retry then caveat Quality metric Untrusted content Source trust tier Fence or drop No tool authority Provenance tag Harmful content Content Safety Category severity Refuse and log Sentinel signal Safety Guardrails — Detect, Decide, Act, Record by Threat Class Security / platform Decision point Application we own Queue / topic Data store Content retrieved by a tool never gains the caller's authority. Fencing happens before the model sees it, not after. v 1.0 · owner Security Architecture · date 2026-08

Decisions

  • Content retrieved by a tool never gains the caller's authority; fencing happens before the model sees it, not after it responds
  • Guardrails are configured per agent from a central catalogue; an agent may add checks but may not remove an organisation-level one
  • Every guardrail decision is an event, so a blocked action is as visible as a completed one

Coverage

  • Input validation, output validation, tool-call validation, policy check, content classification, PII detection and redaction, structured-output enforcement and human escalation
  • Groundedness checking is enabled for retrieval-backed agents and disabled for creative ones, declared in the spec
  • A red-team suite of injection probes runs in CI against every agent version

Risks

  • Guardrails add latency and cost per call; the measured overhead is tracked as an SLI and is part of the case for keeping them in-process
  • Detection is probabilistic — prompt shields reduce injection risk, they do not eliminate it, which is why the sandbox has no default network path
  • False positives block legitimate work; every block is reviewable and the review feeds threshold tuning
◀  Human-in-the-Loop All views Policy and Budget Enforcement  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-08 · 32 views · Microsoft Azure21-guardrail-chain