A model in Microsoft Foundry never runs alone. Around every deployment sits a safety system that Microsoft calls guardrails (formerly content filter). It checks what goes in and what comes out, and it can refuse a request before the model sees it. For the Kladde, that means two things. First, there is one more layer in the cloud that can detect the attacks from T6.1. Second, the code has to be able to deal with a refusal, and that's harder than it sounds: A refusal arrives as an error from the service, and an error is normally retried.
A local model has none of this. The guardrails belong to the deployments in Microsoft Foundry; Foundry Local on your machine doesn't have them (only the version of Foundry Local for Azure Local ships them as a preview). What the service does in the cloud, the application has to do locally, and that's the reason for T6.4.
As always, the cloud parts of this lesson are optional. All exercises run without a subscription: The refusal comes from a stand-in for the endpoint in memory, and you only build the call to Prompt Shields.
The guardrails of Foundry
The guardrails sort text into four categories: hate, sexual, violence and self-harm. For each category, a classifier determines a severity level:
| Severity level | Meaning |
|---|---|
| Safe | nothing harmful detected; noted, but never blocked |
| Low | mild, such as prejudice or mild depictions in a story |
| Medium | moderate, such as graphic depictions or bullying |
| High | severe, such as extremist content or the endorsement of serious harm |
What gets blocked is set by a blocking level for each category. The names are easy to mix up:
| Blocking level | blocks |
|---|---|
| Off | nothing (for outputs only after approval by Microsoft) |
| Low | only High |
| Medium | Medium and High |
| High | Low, Medium and High |
The default is Medium, for the input and for the output. For each control, you can also choose whether it blocks or only annotates: In the second case, the request goes through, and the response says what the classifier found. For the four categories on the output, even plain annotating needs approval by Microsoft. The classifiers are trained and tested on German, among other languages. Microsoft still advises checking false alarms and missed cases with your own texts in every language of the application.