Defense in Depth for AI Agents

One name, two products, two lifecycle stages. Azure AI Content Safety’s Groundedness detection blocks and corrects ungrounded answers at runtime; the Evaluation SDK’s GroundednessEvaluator scores them offline in CI. Here’s the decision boundary for RAG, the without-Foundry path for each, the honest recall numbers, and the open-source substitutes.

Microsoft ships real code for every guardrail layer, but no sample wires them together around one agent. Here’s the reference stack — Presidio for PII, Content Safety for harm categories, NeMo Guardrails for programmable rails, FIDES for deterministic flow control — where each fits in the MAF middleware pipeline, and the licenses.

Prompt Shields is a real input classifier, but it’s probabilistic — and Spotlighting and Groundedness are model-only, so an agent’s tool calls can pass completely unscanned. Here’s what each defense blocks, where the agent coverage gap is, and how to layer probabilistic filters with deterministic controls.