Plan and manage an Azure AI solution 1.4 Implement responsible AI across generative AI and agentic systems

A model deployment's guardrail scans user input and output for Violence.

Study guide skill: Govern agent behavior with oversight modes, constraints, and tool-access controls

Question B4-014

A model deployment's guardrail scans user input and output for Violence. You assign a custom guardrail to an agent that uses this deployment (agent guardrails are in preview). The agent's guardrail has Violence controls for user input and output, but none for the tool call or tool response intervention points. When the agent runs, which content is scanned for Violence?

Select one answer.

  • A User input, output, tool calls, and tool responses, because the agent inherits the deployment guardrail's controls for anything its own guardrail doesn't cover
  • B User input and output, each by whichever of the two guardrails is stricter
  • C Only the model deployment's guardrail applies, because guardrails attach to model deployments, not agents
  • D User input and the final output, by the agent guardrail's controls; tool calls and tool responses aren't scanned for Violence ✓ Correct answer

Answer: D

Risks in an agent are detected based on the guardrail assigned to the agent, and the agent guardrail fully overrides the model's guardrail; nothing is merged or inherited once a custom guardrail is assigned. In the page's own example, user queries and final output are scanned by the agent's controls, while tool calls and tool responses aren't scanned for Violence because the agent guardrail has no controls there. A guardrail can be applied to models and to agents.

Deep dive

How it works

A Foundry guardrail is a set of controls (risk + intervention point + action). One guardrail can be applied to many models and, in preview, to many agents. Agents add intervention points that models don't have, such as tool calls and tool responses.

The key rule is in an Important note: risks in an agent are detected based on the guardrail assigned to the agent, not the guardrail of its underlying model. The agent's guardrail fully overrides the model's guardrail. Nothing is merged, and nothing is inherited for the gaps.

The guardrails page walks through almost exactly this scenario. The model has Violence set to High for input and output, and the agent has Violence set to Low for input and output and no Violence controls for tool calls or responses. The result:

  • User queries to the agent: scanned for Violence at the agent's Low level.
  • Tool calls generated by the model, including content sent to the tool: not scanned for Violence.
  • The tool's response: not scanned for Violence.
  • The final output to the user: scanned at the agent's Low level.

If you want tool calls and responses covered, add controls for those intervention points to the agent's guardrail.

The other options, and when you'd use them

  • Inherit for anything not covered: The agent's guardrail fully overrides the model's, so there's no fallback to the deployment's controls.
  • Whichever is stricter: Detection follows only the agent's guardrail, even when the model's is stricter (High vs Low in the example).
  • Only the deployment's guardrail applies: Guardrails can be applied to agents as well as models, and the agent's one wins.

Exam tip

Agent guardrail assigned = it alone applies (full override). Uncovered intervention points aren't scanned.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Plan and manage questions · AI-103 study guide

Thanks for your feedback!