Gate outputs before releasing business results

Learning objective

Enforce output content-safety, grounding, schema, and business-policy constraints.

Core idea

An output is usable only when it satisfies every required acceptance condition. A safe sentence can contain an unsupported claim; a grounded answer can violate a refund policy; valid JSON can carry the wrong account identifier. Treat these as independent checks whose results converge on one release decision.

For a multi-agent solution, validate both specialist results consumed by another agent and the final result released to the caller. The final writer can introduce claims that no specialist supplied. Conversely, rejecting only the final answer does not undo an intermediate action. See 4.2.3 for authorization before side effects and 4.2.4 for screening untrusted tool evidence. This lesson owns the acceptance of generated output.

How it works

Check content safety against explicit thresholds

Microsoft Foundry provides an Output intervention point for final content. Choose the control’s action deliberately: Annotate only provides a signal, while blocking requires Annotate and block. See 4.2.1 for native control configuration. Do not infer that a configured annotation prevents delivery.

For application-managed text checks, Azure AI Content Safety’s Python interface uses ContentSafetyClient.analyze_text(AnalyzeTextOptions(text=...)). The response’s categories_analysis contains category and severity values. The documented categories include TextCategory.HATE, TextCategory.SELF_HARM, TextCategory.SEXUAL, and TextCategory.VIOLENCE. The application compares those results with its approved policy and decides whether to release the content; the analysis call itself is not that release decision.

Keep a moderation failure distinct from a successful analysis that reports acceptable content. A missing response, malformed result, or exception does not establish that the text passed. Define how those unknown outcomes affect delivery in 4.2.7 rather than converting them into an empty list of detected risks.

Check support against the supplied evidence

The native Foundry Groundedness (Preview) guardrail control supports models but not agents. Assigning a guardrail containing that control to an agent does not make it effective for agent output; use an application-side check such as the standalone API described here.

Azure AI Content Safety’s Groundedness detection is documented as preview. Its quickstart calls POST /contentsafety/text:detectGroundedness?api-version=2024-09-15-preview, supplying the generated text and groundingSources. Use the actual authorized evidence used for this answer, rather than unrelated documents that happen to support a similar statement.

The result’s ungroundedDetected flags detected ungroundedness. ungroundedPercentage is a proportion from 0 to 1, not a confidence score. A value of 0.2 means the service identified a portion of the text as ungrounded; it does not mean an 80% probability that the entire answer is true.

The quickstart limits checked text to 7,500 characters. Design the acceptance stage to handle an oversized answer explicitly rather than silently checking its first fragment. For question answering, supply task: "QnA" and the question through qna.query; for a summary, use task: "Summarization". The documented reasoning option defaults to false; enabling it adds processing time and requires the supported Azure OpenAI resource described in the quickstart.

Grounding is relative to evidence. It cannot establish that a stale policy document is authoritative or that the principal may access it. Preserve evidence identity and freshness checks separately. A copied source citation alone does not prove that the accompanying claim follows from the source.

Constrain structure without confusing it with semantics

JSON mode guarantees valid JSON but does not enforce adherence to a supplied schema. For supported direct Azure OpenAI model calls, structured outputs constrain a supplied JSON Schema. Chat Completions uses response_format; Responses uses text.format. In the Responses format, type, name, schema, and strict are sibling properties, with type: "json_schema" and strict: true.

The supported schema subset requires all fields to be required and additionalProperties: false on objects. A nullable union represents an optional value. Microsoft documents a maximum of 100 object properties in total and five nesting levels. Numeric minimum and maximum, and string pattern and format, are among the unsupported keywords, so do not depend on them to enforce monetary limits or identifier formats at generation time.

The structured-output page explicitly excludes Foundry Agents Service and Assistants. Scope this generation mechanism to the supported direct model interface; do not assume that sending an agent reference makes every model-format feature available. Regardless of the generation interface, validate the received result in the application before consuming it. An incomplete or nonconforming result must not become an accepted business object.

Apply business rules to authoritative values

Business validity requires code that joins the output to trusted state. For a proposed refund, verify the account, purchased item, currency, remaining refundable balance, and the applicable policy version. A schema can require amount to be a number but cannot prove that the amount is permitted for this customer.

Agent Framework’s Python Agent Hooks provides an output interception point before final delivery. It is experimental, emits ExperimentalWarning, and is not implemented for .NET or Go. In mode="enforce", an interceptor can return Verdict.deny(...) to prevent release. mode="evaluate_only" records the verdict without blocking or transforming execution. See 4.2.6 for custom rule and escalation design.

Validate the exact candidate that is released. If redaction, correction, or regeneration changes it, repeat the checks affected by that change. Attach an application-defined acceptance record to the candidate identifier and policy version so another stage cannot substitute unchecked content.

Key distinctions and trade-offs

The four checks answer different questions:

Run independent checks concurrently only when they inspect the same immutable candidate. Ordering can reduce wasted work, but every required check must complete before release. Keep each failed check visible rather than reducing all failures to “bad answer.”

Architecture / decision scenario

A customer-support system combines a policy specialist, an account specialist, and a final writer. The writer proposes a structured explanation and refund amount. A direct model call uses text.format to constrain that object, while application validation rejects incorrect currency and account references.

The release stage analyzes the explanation with Content Safety, checks it against the approved policy excerpts through the preview groundedness API, and compares the proposed amount with the authoritative refundable balance. A schema-valid proposal for a larger amount fails business policy. A permitted amount accompanied by an invented processing guarantee fails grounding. Harmful language fails content policy even if every financial field is correct.

Only a candidate that passes all required checks reaches the caller. A redacted replacement is checked again, and the refund execution still passes the separate authorization and approval gate in 4.2.3. An unavailable detector yields an unknown outcome handled under 4.2.7.

Common exam traps

• Treating valid JSON as schema adherence or business authorization.
• Treating ungroundedPercentage as confidence in factual correctness.
• Enabling the native Groundedness (Preview) control on an agent and expecting it to check agent output.
• Configuring Annotate only and expecting automatic blocking.
• Applying direct-model structured-output support to every agent interface.
• Checking one candidate and releasing a regenerated replacement unchecked.
• Assuming a final-output rejection reverses an earlier tool action.

What to remember

Output acceptance is the conjunction of content-safety, evidence-support, structural, and business-policy checks. Name the API and result field for each check, preserve unknown outcomes, and release only the candidate that passed. Generation constraints help produce a usable shape; application enforcement decides whether the result is usable.

Knowledge check

References

• Microsoft, Intervention points concepts

• Microsoft, Quickstart: Analyze text content

• Microsoft, Quickstart: Groundedness detection (preview)

• Microsoft, How to use structured outputs with Azure OpenAI in Microsoft Foundry Models

• Microsoft, Agent hooks

• Microsoft, Guardrails and controls overview in Microsoft Foundry