Guardrails

One name, two products, two lifecycle stages. Azure AI Content Safety’s Groundedness detection blocks and corrects ungrounded answers at runtime; the Evaluation SDK’s GroundednessEvaluator scores them offline in CI. Here’s the decision boundary for RAG, the without-Foundry path for each, the honest recall numbers, and the open-source substitutes.

Microsoft ships real code for every guardrail layer, but no sample wires them together around one agent. Here’s the reference stack — Presidio for PII, Content Safety for harm categories, NeMo Guardrails for programmable rails, FIDES for deterministic flow control — where each fits in the MAF middleware pipeline, and the licenses.

Prompt Shields is a real input classifier, but it’s probabilistic — and Spotlighting and Groundedness are model-only, so an agent’s tool calls can pass completely unscanned. Here’s what each defense blocks, where the agent coverage gap is, and how to layer probabilistic filters with deterministic controls.

Microsoft Agent Framework’s latest releases, Python 1.10.0 (June 30) and .NET 1.12.0 (July 2), change a security default that’s easy to miss in the changelog: agent tools and file access now require approval unless you opt out. Both land as breaking changes.

The OWASP LLM Top 10 exists because shipping an LLM to production without a security model is a new category of risk that the existing web application security playbook doesn’t fully cover. Prompt injection has held the #1 spot on that list since the first version was published, and it’s not there because researchers think it might be a problem someday. It’s been demonstrated against production systems at companies that knew what they were doing.