EzCloudInfo

In my previous article, “From Prompt to Privilege Practical Guardrails for Securing Agentic AI and MCP,” we looked at Agentic AI security from a broader architectural perspective.
The key takeaway was simple: securing AI systems cannot rely on a single control.
As AI applications evolve from answering questions to retrieving enterprise data, calling tools, interacting with APIs and eventually performing actions on behalf of users, the security model also needs to evolve. Identity, authorization, data protection, prompt protection, content filtering, monitoring and agent behaviour controls all become part of the same security story.

But architecture diagrams are only the beginning.

The next question is:

What do these guardrails actually look like when we implement them?
That is what I want to explore in this series.
Rather than trying to cover every AI security control in one large article, I will take them one at a time, deploy them, test them and document what happens.

For the first control, I am starting with Azure AI Content Safety.
Microsoft describes Azure AI Content Safety as a service for detecting harmful user-generated and AI-generated content.
Its capabilities include text and image analysis, Prompt Shields, groundedness detection, protected material detection, custom categories and Task Adherence.

Why start with Azure AI Content Safety?
When we think about securing a traditional application, we normally place controls around identities, networks, applications and data.

Generative AI introduces an additional trust boundary:

Natural language input itself.

A user prompt might simply ask a valid business question.
But the same interface can also be used to attempt to manipulate the model, override system instructions, inject hidden instructions or push the model towards unsafe responses.
So before we move deeper into areas such as agent permissions, tool invocation and MCP controls, it makes sense to first look at what is entering the AI system.
Microsoft’s Azure AI security guidance similarly recommends a layered approach, including analyzing input for malicious content and prompt injection attempts alongside output filtering and other application controls.

For this first hands on exercise, I therefore kept the scope deliberately small:

Text moderation : Can Azure identify potentially harmful text?
Prompt Shields : Can Azure recognize a prompt attempting to manipulate the model?