- Home
- AI agents
- Guardrails
- Guardrails on Azure, AWS and Google
Govern and secure · Guardrails
Guardrails on Azure, AWS and Google: which product does what?
Azure's guardrails are Azure AI Content Safety and Microsoft Foundry's guardrails and controls, with Copilot Studio and Defender adding runtime checks on tool calls. AWS has Amazon Bedrock Guardrails plus AgentCore Policy at the gateway. Google Cloud has Model Armor, enforced through Agent Gateway and floor settings. Each ships defaults worth changing, listed below.
In this guide: 83 pages
Key takeaways
- Microsoft spreads guardrails across four products: Azure AI Content Safety (the classifiers), Foundry guardrails and controls (the policy that applies them, agent part in preview), Copilot Studio (built-in blocking plus external detection in preview) and Defender (runtime blocking, coverage mixed).
- AWS has two: Bedrock Guardrails for text, generally available, and AgentCore Policy for tool calls, generally available since 3 March 2026, with enforcement across accounts through AWS Organizations.
- Google has one, Model Armor, applied at three places: model calls, Google-managed MCP servers (generally available 22 April 2026) and Agent Gateway (generally available 24 June 2026), with floor settings and, since 21 October 2026, organization policies that require filters.
- Four defaults to change on day one: Copilot Studio detection fails open after one second and is per environment; Bedrock skips tool results and leaves logs unmasked; Foundry document attack detection is off and an agent guardrail overrides the model's; Gemini safety thresholds are off by default on newer models.
What does Microsoft offer on Azure and Microsoft 365?
Microsoft offers the classifiers in Azure AI Content Safety, applies them through Microsoft Foundry guardrails and controls, and adds runtime checks for Copilot Studio and Agent 365 through Defender. The table gives each product, what it does and the status its Learn page showed on 2 November 2026.
Microsoft guardrail products, as seen 2 Nov 2026.
| Product | What it does | Status (Learn page date) | Default to check |
|---|---|---|---|
| Azure AI Content Safety: Prompt Shields | Detects user prompt attacks and document attacks in documents, emails and web pages; standalone API takes a user prompt plus up to five documents | Generally available since Aug 2024; October 2026 classifier update rolling out from Spain Central (20 Oct 2026) | Document attack detection is off by default in Foundry; trained mainly on English |
| Spotlighting | Base64-encodes third-party documents to mark them as low trust | Preview; Chat Completions API only, not for agents (28 Aug 2026) | Off by default; raises token counts |
| Task Adherence | Flags a planned tool call that does not match the user's intent; can block or escalate | Public preview since Nov 2025 | Data may be processed in US or EU regions |
| Microsoft Foundry guardrails and controls | A named set of controls (risk, intervention point, action) applied to models and agents; four intervention points; network egress controls for hosted agents | Agent guardrails preview; tool call and tool response points preview (20 Oct 2026) | An agent guardrail fully overrides the model's; agents without one inherit the model deployment's; applies only to Foundry Agent Service agents |
| Groundedness detection | Checks answers against supplied sources; correction rewrites ungrounded text | Preview; retires 30 Apr 2027 (20 Oct 2026) | Not supported for agents; plan the replacement now |
| Copilot Studio built-in protection and external threat detection | Built-in blocking of user and cross-domain prompt injection; external detection posts the prompt, history, prior tool outputs and proposed call to your endpoint before every tool invocation | External detection preview (1 Jun 2026); generative orchestration only | Allows the call if no answer within one second; set per environment with no tenant-wide switch |
| Microsoft Defender real-time protection for AI agents | Blocks secret exfiltration, malicious content propagation, evasion techniques and unsafe email domains at run time | Agent 365 tool calls through Work IQ MCP; Copilot Studio agents preview; Foundry agents preview; local agents through Defender for Endpoint (1 Jul 2026) | The default rule audits; custom rules block |
| Defender for Cloud threat protection for AI services | Alerts on jailbreak, data leakage, data poisoning and credential theft, using Prompt Shields and Microsoft threat intelligence | Generally available (19 May 2026) | Text tokens only; not for Azure Government or connected AWS accounts |
| Azure API Management AI gateway policies | llm-content-safety sends prompts to Content Safety and returns 403 on violation; llm-token-limit sets tokens per minute and quotas; covers MCP and A2A APIs managed in APIM | Documented with no preview label (18 Aug 2026 and 1 Apr 2026) | Token counters are per gateway, not global |
Two more Microsoft controls live outside the guardrail products and matter as much: Purview DLP for Microsoft 365 Copilot can exclude labelled files from grounding and block prompts with sensitive information types (preview), and Copilot Studio data policies restrict which connectors an agent may use.
What does AWS offer?
AWS offers Amazon Bedrock Guardrails for everything that is text and AgentCore Policy for everything that is a tool call, with enforcement across an organization through AWS Organizations. Both are generally available.
AWS guardrail products, as seen 2 Nov 2026.
| Product | What it does | Status | Default to check |
|---|---|---|---|
| Amazon Bedrock Guardrails | Content filters (hate, insults, sexual, violence, misconduct, prompt attack), denied topics, word filters, sensitive information filters, contextual grounding checks, Automated Reasoning checks; inline with InvokeModel and Converse or standalone through ApplyGuardrail for any model | Generally available | Does not evaluate reasoning content blocks; prompt attack filter needs input tags with InvokeModel |
| Safeguard tiers | Standard: stronger prompt-attack detection, prompt leakage detection, code-aware filtering, wider language coverage, uses cross-Region inference. Classic: English, French, Spanish | Documented; code-coverage launch date not stated | Classic is the narrower tier; Standard routes across Regions |
| Prompt attack filter | Jailbreaks, prompt injection and (Standard) prompt leakage on user input | Documented | Does not evaluate toolResult content or tool definitions |
| Sensitive information filters | Block or mask built-in PII types (general, finance, IT including AWS keys, US, Canada, UK) and custom regex, separately for input and output | Documented | Masking does not reach model invocation logs, the trace match field, tool call arguments, tool results or tool definitions |
| Automated Reasoning checks | Formal-logic validation of answers against a policy extracted from your documents | Generally available 6 Aug 2025 | Detect only; English (US); no streaming; encoded text may skip evaluation; not supported in enforcements |
| Guardrails enforcements | Organization-level through AWS Organizations Bedrock policies and account-level through PutEnforcedGuardrailConfiguration; applies to InvokeModel, Converse and streaming | Documented; launch date not stated | Organization, account and request guardrails combine with the most restrictive winning; a higher guardrail is not added to a lower one |
| Bedrock AgentCore Policy | Cedar policies (or plain English converted to Cedar) attached to an AgentCore Gateway; evaluates every agent-to-tool request against caller identity and arguments; log-only or enforce | Preview 2 Dec 2025; generally available 3 Mar 2026 in 13 Regions | Start in log-only mode, then enforce |
No native per-agent spend cap was confirmed on AgentCore on the pages read; AWS Budgets and CloudWatch alarms monitor spend, and a hard stop needs a request or usage limit enforced elsewhere. AgentCore Policy can also apply a Bedrock guardrail at the gateway layer (release notes, July 2026), which is one way to put a check on tool traffic.
What does Google Cloud offer?
Google Cloud offers Model Armor as the one guardrail service and applies it at the model call, at Google-managed MCP servers and at Agent Gateway, with floor settings and organization policies to keep projects from opting out. Gemini models also carry their own safety filters with thresholds you set.
Google Cloud guardrail products, as seen 2 Nov 2026.
| Product | What it does | Status | Default to check |
|---|---|---|---|
| Model Armor | Screens prompts and responses for prompt injection and jailbreak, responsible-AI categories, sensitive data (basic or Sensitive Data Protection templates), malicious URLs (first 256); inspect only or inspect and block; image screening preview | Introduced 3 Feb 2025; release notes show no separate GA label for the core service | Inputs under three words return no match; Google advises a High threshold for apps such as Gemini Enterprise to limit false positives |
| Model Armor integrations | GKE; Gemini Enterprise; Gemini Enterprise Agent Platform; Google-managed MCP servers; Agent Gateway; streaming sanitization | GKE generally available 15 Sep 2025; Gemini Enterprise 16 Sep 2025; agent platform 3 Dec 2025; MCP servers 22 Apr 2026; Agent Gateway 24 Jun 2026; streaming 10 Jul 2026 | Each integration is enabled per resource |
| Floor settings and organization policies | Minimum filters per project; custom organization policies that require filters in new or updated templates | Floor settings documented since 2025; organization policies generally available 21 Oct 2026 | Set the floor before teams create templates |
| Gemini safety filters | Non-configurable blocking of CSAM and sensitive PII; configurable hate, harassment, sexually explicit and dangerous content thresholds; jailbreak classifier in preview on one model | Documented | Threshold OFF is the default for gemini-3.5-flash and later, so set it |
Google does not publish a separate tool-call policy engine; the enforcement point is Agent Gateway, which also enforces the Agent Registry, so the registry and the guardrail share one choke point.
Which shipped defaults should you change first?
Change the defaults that fail open, the ones that skip a channel and the ones that do not propagate, in that order. These eight are documented on the vendor pages and matter from the first deployment.
- Copilot Studio external threat detection: set the error behaviour to Block the query. By default the agent allows the tool call if no decision arrives within one second.
- Copilot Studio external threat detection: enable it in every environment and add it to the environment creation runbook. There is no tenant-wide setting, PowerShell or API to propagate it.
- Bedrock prompt attack filter: wrap user content in input tags on every InvokeModel call, and run ApplyGuardrail on tool results, since the filter does not evaluate toolResult content or tool definitions.
- Bedrock sensitive information filters: turn on CloudWatch log data protection, because the input field in invocation logs keeps the original request and the trace match field holds the raw value.
- Foundry: enable document attack detection (off by default), assign a guardrail to each agent with the tool call and tool response intervention points, and remember that the agent guardrail fully overrides the model's.
- Defender real-time protection: the default rule audits. Write custom rules that block for secret exfiltration and unsafe email domains.
- Model Armor: set floor settings per project, apply the organization policy that requires filters, and pick a threshold with your own false-positive data rather than the lowest one.
- Gemini safety filters: set the harm thresholds explicitly, since the documented default for gemini-3.5-flash and later is OFF.
Log every one of these as a configuration item with an owner, because a new environment, account or project resets most of them.
How do Microsoft, AWS and Google implement it?
The enforcement points by cloud, with statuses as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Where the text check runs | Azure AI Content Safety classifiers, applied by Foundry guardrails per deployment or agent | Bedrock Guardrails inline with InvokeModel or Converse, or standalone through ApplyGuardrail | Model Armor on the model call, with floor settings per project |
| Where the tool-call check runs | Foundry tool call point (preview); Copilot Studio external detection (preview); Defender rules | AgentCore Policy at the AgentCore Gateway (generally available 3 Mar 2026) | Model Armor on Agent Gateway (generally available 24 Jun 2026) |
| How it is enforced organization-wide | Per deployment, agent or environment; no tenant-wide switch for Copilot Studio detection | AWS Organizations Bedrock policies; account-level enforced guardrails | Floor settings; custom organization policies requiring filters (generally available 21 Oct 2026) |
| What fails open or is skipped | Copilot Studio detection allows after one second; Foundry document attacks off by default; Spotlighting and groundedness not for agents | Tool results, tool definitions and tool arguments skipped by the prompt attack and PII filters; untagged input unfiltered; logs unmasked | Inputs under three words return no match; Gemini thresholds OFF by default on newer models |
Google's release notes carry the "Gemini Enterprise Agent Platform" name for the agent platform integration (generally available 3 Dec 2025); the platform was renamed from Vertex AI on 22 Apr 2026.
Frequently asked questions
Is Azure AI Content Safety the same thing as Foundry guardrails?
No. Azure AI Content Safety provides the classifiers (Prompt Shields, harm categories, protected material). Foundry guardrails and controls are the policy layer that applies those classifiers to a model deployment or an agent at chosen intervention points. The agent part of that policy layer was in preview on 2 November 2026.
Does Bedrock Guardrails cover AgentCore agents?
Yes for model calls, no for tool traffic by default. Guardrails evaluate prompts and responses on InvokeModel, Converse or ApplyGuardrail, and skip tool results, tool definitions and tool arguments. AgentCore Policy covers the tool call, and can apply a guardrail at the gateway layer.
Is Model Armor generally available?
Google's release notes list Model Armor as introduced on 3 February 2025 without a separate GA label for the core service. Its integrations carry explicit GA dates: GKE and Gemini Enterprise in September 2025, MCP servers on 22 April 2026, Agent Gateway on 24 June 2026 and streaming sanitization on 10 July 2026.
Which cloud makes organization-wide enforcement easiest?
AWS and Google both offer an organization-level control: AWS Organizations Bedrock policies and Model Armor floor settings with organization policies. Microsoft enforces per deployment, agent or environment, and Copilot Studio external detection has no tenant-wide switch, so Microsoft tenants need the setting in their environment runbook.
More in Guardrails
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- Prompt Shields in Azure AI Content Safety
- What's new in Azure AI Content Safety
- Guardrails and controls overview in Microsoft Foundry
- Enable external threat detection and protection for Copilot Studio custom agents (preview)
- Real-time protection for AI agents during runtime
- Threat protection for AI services (Defender for Cloud)
- Azure API Management llm-content-safety policy
- Azure API Management llm-token-limit policy
- Learn about the Microsoft 365 Copilot location for data loss prevention
- Amazon Bedrock Guardrails overview
- Safeguard tiers for guardrails policies
- Detect prompt attacks with Amazon Bedrock Guardrails
- Remove PII from conversations by using sensitive information filters
- Automated Reasoning checks in Amazon Bedrock Guardrails
- Enforce guardrails across accounts (Guardrails enforcements)
- Automated Reasoning checks in Amazon Bedrock Guardrails are now generally available
- Policy in Amazon Bedrock AgentCore is now generally available
- Amazon Bedrock AgentCore release notes
- Model Armor overview
- Model Armor release notes
- Configure safety filters (Gemini)
- Gemini Enterprise Agent Platform release notes
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner