AI-103 Practice Question 21: Guardrail Intervention Points
Microsoft Azure AI Apps and Agents Developer Associate (AI-103) · Test 3 · question 1 of 10
A support agent in Foundry Agent Service reads ticket text through an MCP tool that pulls from a third-party helpdesk. The team assigned a guardrail to the model deployment with hate and violence controls on user input and on output. In testing, abusive language that arrives in the tool's response is carried into the agent's final answer without being flagged at the point it enters the conversation, even though the same words typed by a user are caught immediately.
What should the team do?
Show answer and explanation
Answer:
Foundry guardrails scan at four intervention points: user input, tool call, tool response, and output. The applicability table is the key: *tool call* and *tool response* apply to agents only; they are marked not applicable to models. A guardrail attached to a model deployment therefore has no way to inspect what a tool returns, which is exactly the gap here. The other half of the rule matters too: risks are detected in an agent based on the guardrail it is assigned, and an agentic guardrail fully overrides the model's guardrail.
- A is wrong because a threshold only changes *how much* content is flagged at the points that are being scanned. The tool response is not scanned at all on a model guardrail, so no threshold value produces a detection there. - B is wrong twice over: annotate is listed as not applicable to agents (agents support annotate and block only), and annotating rather than blocking would let the content through even if it were detected. - D is wrong because a blocklist matches literal terms and, like the rest of the model deployment's guardrail, still never runs against the tool response.
Reference: Guardrails and controls overview in Microsoft Foundry