Plan and manage an Azure AI solution 1.4 Implement responsible AI across generative AI and agentic systems
A company has dozens of model deployments across many resource groups in one subscription.
Study guide skill: Govern agent behavior with oversight modes, constraints, and tool-access controls
Question B3-007
A company has dozens of model deployments across many resource groups in one subscription. Every deployment must meet minimum guardrail controls for content safety, prompt injection, and protected material, except deployments in one sandbox resource group, and administrators need to see which deployments aren't compliant. What should you do?
Select one answer.
Answer: D
A Foundry Control Plane guardrail policy defines the minimum guardrail controls (content safety, prompt injection, protected materials) a model deployment needs to be compliant; you can scope it to a subscription, add exceptions for whole resource groups, and review compliance on the Compliance pane (creating it requires Owner or Resource Policy Contributor). Per-deployment edits give no fleet-wide compliance view. Purview provides auditing and data security governance over prompt and response data rather than deployment guardrails, and scoping to the sandbox does the opposite of what's required.
Deep dive
How it works
Foundry Control Plane governs a whole fleet of model deployments with guardrail policies. A policy sets the minimum guardrail controls, such as content safety, prompt injection and protected materials, that a deployment needs to count as compliant.
Creating one for this requirement:
- In the Foundry (new) portal, go to Operate > Compliance > Create policy. You need Owner or Resource Policy Contributor at the subscription or resource group level.
- Add the controls: content safety, prompt injection, protected materials.
- Set the scope to the subscription, so every resource group is covered, including deployments created later.
- Add an exception for the sandbox resource group. With subscription scope, exceptions can cover whole resource groups or individual deployments.
The Compliance pane then shows noncompliant policies with a "Violations detected" value. Select a policy and an asset to compare its guardrail settings with what the policy requires, and fix the gaps.
The other options, and when you'd use them
- Purview DSPM for AI: Purview provides auditing, classification and DSPM for AI over prompt and response data. It doesn't set guardrail minimums on deployments; guardrails do that at the model layer.
- Edit each deployment by hand: That's no fleet-wide compliance view. The policy is designed to govern guardrail controls for model deployments across a subscription, and Compliance reports the violations.
- Policy scoped to the sandbox only: That's backwards. Scope to the subscription and add the sandbox resource group as an exception.
Exam tip
Minimum guardrails across many deployments, with exceptions and a compliance view = Foundry Control Plane guardrail policy at subscription scope, sandbox as an exception.
References
Last reviewed: