---
schema_version: "1"
id: e1ceb5bd7a66dbb6850929a227f79d66afcd56e12712a593857e428f0e0545b2
title: A2A v1 Azure Content Guardrails Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-included-a2a-v1-azure-guardrails.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-included-a2a-v1-azure-guardrails
source_site: docs.mulesoft.com
content_type: documentation
content_hash: e2635ba1e5519e660c7dcdcf6ff00293f15f68e129f90e8318e8dc3937771610
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
keywords: api gateway, flex gateway, gateway, policy, a2a, azure, content safety, guardrails, harm detection, jailbreak, hallucination
---

# A2A v1 Azure Content Guardrails Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>A2A v1 Azure Content Guardrails Policy</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Evaluates A2A v1 agent messages against Azure AI Content Safety for harmful content, jailbreak attempts, hallucinations, and copyrighted material</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>A2A</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.13.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/a2a-v1-azure-guardrails-release-notes">A2A v1 Azure Content Guardrails Policy</a></p></td></tr><tr><td rowspan="2"><p><strong>Returned Status Codes</strong></p></td><td><p>403 - Forbidden: Content violates Azure Content Safety policies</p></td></tr><tr><td><p>503 - Service Unavailable: Azure API call failed (only when fail-open is disabled)</p></td></tr></tbody></table>

## Summary

The A2A v1 Azure Content Guardrails policy provides comprehensive content moderation for A2A v1.0
agent traffic by evaluating requests and responses against the Azure AI Content Safety service. The
policy integrates with
[Azure AI Content Safety](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/overview)
to enforce content safety policies including:

- **Content filters**: Detects and blocks harmful content across four categories (**Hate**,
  **SelfHarm**, **Sexual**, and **Violence**) with configurable severity thresholds (`0`, `2`, `4`,
  `6`).

- **Prompt Shield**: Detects jailbreak attempts and indirect prompt-injection attacks using Azure’s
  advanced detection capabilities.

- **Blocklists**: Blocks content matching Azure-managed custom blocklists you define in Azure
  Content Safety Studio.

- **Groundedness Detection**: Evaluates whether agent responses are grounded in provided reference
  text (hallucination detection for RAG applications).

- **Protected Material Detection**: Detects known copyrighted text in agent responses.

The policy operates across three A2A v1.0 transport protocols:

- **JSON-RPC** — Moderates `SendMessage` and `SendStreamingMessage` on both request and response

- **HTTP+JSON** — Moderates `POST /message:send` and streaming responses

- **gRPC** — Pass-through without moderation in v1.0

The policy operates in independent phases:

- **Request phase**: Moderates user messages before they reach the upstream agent, preventing
  harmful or inappropriate messages from being processed.

- **Response phase**: Moderates agent responses before they reach the client, ensuring outputs
  comply with safety policies.

- **Streaming response phase**: Best-effort moderation of streaming responses by buffering frame
  bodies and scanning on configurable thresholds.

When content violates safety policies, the request is rejected with a `403` error code and never
reaches the agent (request phase) or the client receives a `403` instead of the agent response
(response phase).

> [!NOTE] This policy is designed for A2A v1.0 traffic only. gRPC traffic passes through without
> moderation in this version.

## Before You Begin

Before configuring this policy, you need:

1.  **Azure Account** with access to Azure AI Content Safety

2.  **Azure Content Safety Resource** created in the Azure Portal

3.  **Subscription Key** from the Azure Portal (Keys and Endpoint section)

4.  **Resource Endpoint URL** from the Azure Portal configured as a Flex service

## Configuring Policy Parameters

### Omni Gateway Local Mode

The A2A v1 Azure Content Guardrails policy isn’t supported in Local Mode.

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

### Basic Configuration

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Azure Content Safety Endpoint</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Azure Content Safety endpoint base URL configured as a Flex service, for example, <code>https://&lt;resource&gt;.cognitiveservices.azure.com</code>. The policy appends endpoint paths at runtime.</p></div></div></td></tr><tr><td><div><div><p>Azure API Key</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Azure Content Safety subscription key. The key is passed in the <code>Ocp-Apim-Subscription-Key</code> header and marked as sensitive.</p></div></div></td></tr><tr><td><div><div><p>Moderate Request</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, evaluates the user message against Azure Content Safety before forwarding to the upstream agent. Rejected messages never reach the agent. Default: <code>true</code>.</p></div></div></td></tr><tr><td><div><div><p>Moderate Response</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, evaluates the agent response against Azure Content Safety before returning to the client. Rejected responses return <code>403</code> error code. Default: <code>true</code>.</p></div></div></td></tr><tr><td><div><div><p>Moderate Streaming Response</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, evaluates streaming responses by buffering frame bodies and scanning on configurable thresholds. When disabled, streaming responses pass through unchanged. Default: <code>true</code>.</p></div></div></td></tr><tr><td><div><div><p>Default Severity Threshold</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Severity threshold applied to all four harm categories (Hate, SelfHarm, Sexual, Violence). Content with severity at or above this value is rejected. Supported values are <code>0</code>, <code>2</code> (default), <code>4</code>, and <code>6</code>.</p></div><div><p>For details, see <a href="#severity-thresholds">Severity Thresholds</a>.</p></div></div></td></tr></tbody></table>

### Advanced Configuration

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>API Version</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Azure Content Safety API version used for all endpoint calls. Default: <code>2024-09-01</code>.</p></div><div><p>To enable Groundedness Detection, override this to a supported preview version, for example, <code>2024-09-15-preview</code>.</p></div></div></td></tr><tr><td><div><div><p>Enable Prompt Shield</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, calls <code>text:shieldPrompt</code> alongside <code>text:analyze</code> on the request to detect jailbreak attempts and indirect prompt-injection attacks. Default: <code>true</code>.</p></div></div></td></tr><tr><td><div><div><p>Hate Severity Threshold</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Per-category override for the Hate harm category. Leave as <code>default</code> to inherit Default Severity Threshold. See <a href="#severity-thresholds">Severity Thresholds</a> for supported values.</p></div></div></td></tr><tr><td><div><div><p>SelfHarm Severity Threshold</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Per-category override for the SelfHarm harm category. Leave as <code>default</code> to inherit Default Severity Threshold. See <a href="#severity-thresholds">Severity Thresholds</a> for supported values.</p></div></div></td></tr><tr><td><div><div><p>Sexual Severity Threshold</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Per-category override for the Sexual harm category. Leave as <code>default</code> to inherit Default Severity Threshold. See <a href="#severity-thresholds">Severity Thresholds</a> for supported values.</p></div></div></td></tr><tr><td><div><div><p>Violence Severity Threshold</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Per-category override for the Violence harm category. Leave as <code>default</code> to inherit Default Severity Threshold. See <a href="#severity-thresholds">Severity Thresholds</a> for supported values.</p></div></div></td></tr><tr><td><div><div><p>Blocklist Names</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Names of Azure-managed blocklists (created in Azure Content Safety Studio) to evaluate against the input text.</p></div></div></td></tr><tr><td><div><div><p>Enable Groundedness Detection</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, calls <code>text:detectGroundedness</code> on the agent response to detect hallucinated statements. Requires Moderate Response enabled and Grounding Source Selector to be set. Only available in Azure regions that support the API, and only on preview API versions (for example, <code>2024-09-15-preview</code>).</p></div></div></td></tr><tr><td><div><div><p>Grounding Source Selector</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>DataWeave expression resolving the grounding source text from the canonical A2A request body. Required when Groundedness Detection is enabled. For example: <code>#[payload.params.message.metadata.context]</code>.</p></div></div></td></tr><tr><td><div><div><p>Enable Protected Material Detection</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, calls <code>text:detectProtectedMaterial</code> on the agent response to detect known copyrighted text. Requires Moderate Response enabled.</p></div></div></td></tr><tr><td><div><div><p>API Timeout (ms)</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Per-request timeout for each Azure Content Safety API call in milliseconds. Must be between 1000 and 30000. Default: <code>5000</code>.</p></div></div></td></tr><tr><td><div><div><p>Fail Open</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Determines behavior when the Azure API call fails or times out:</p></div><div><ul><li><p>Disabled (default): Rejects the request with HTTP <code>503</code></p></li><li><p>Enabled: Allows traffic to proceed without moderation (fail-open mode)</p></li></ul></div></div></td></tr><tr><td><div><div><p>Streaming Min Buffer Chars</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Minimum number of characters accumulated across consecutive SSE frame bodies before the policy calls Azure for moderation. Must be between 1 and 8192. Default: <code>256</code>.</p></div></div></td></tr><tr><td><div><div><p>Max Payload Bytes</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Maximum request-or-response body size (in bytes) that the policy will send to Azure. Must be between 1024 and 10000. Default: <code>10000</code>.</p></div></div></td></tr><tr><td><div><div><p>Sampling Rate Percent</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Percentage of sessions to sample for moderation. <code>100</code> (default) moderates every request; <code>50</code> moderates half of sessions; <code>0</code> disables moderation. Sampling is deterministic per session.</p></div></div></td></tr><tr><td><div><div><p>Session Key Selector</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>DataWeave expression resolving the session identifier used by the sampler. Defaults to <code>#[payload.params.message.contextId default payload.params.message.messageId]</code>. Only used when Sampling Rate Percent is less than 100.</p></div></div></td></tr></tbody></table>

## How This Policy Works

The A2A v1 Azure Content Guardrails policy integrates with Azure AI Content Safety to evaluate A2A
v1.0 agent messages and responses against configurable safety policies.

### Supported Methods

The policy runs only on these A2A v1.0 methods:

- `SendMessage`

- `SendStreamingMessage`

Read-only methods (`GetTask`, `ListTasks`, push-notification methods, `SubscribeToTask`,
`GetExtendedAgentCard`) and the agent-card endpoint pass through untouched. Non-A2A traffic also
passes through.

### Transport Support

The policy moderates these transports:

- **JSON-RPC** — Full moderation on request and response

- **HTTP+JSON** — Full moderation on request and response

**gRPC pass-through**: Requests and responses with `content-type: application/grpc` or
`application/grpc+proto` skip this policy entirely and pass through unchanged. If you need gRPC
moderation, route gRPC clients through an HTTP+JSON transcoder.

### Request and Response Moderation

The policy supports independent evaluation for request and response:

1.  **Request Phase** (when `moderateRequest` is enabled):

    1.  The policy extracts the raw request body.

    2.  The policy sends the body to Azure Content Safety APIs in parallel:

        - `text:analyze` — Evaluates harm categories (Hate, SelfHarm, Sexual, Violence) and checks
          blocklists

        - `text:shieldPrompt` — Detects jailbreak attempts and indirect injections (when
          `enablePromptShield` is enabled)

    3.  If the request violates any policies, the policy blocks the request and returns a `403`
        error code to the client.

    4.  If the request passes, the policy forwards the original request to the upstream agent.

2.  **Response Phase — Unary** (when `moderateResponse` is enabled):

    1.  The policy intercepts the agent response.

    2.  The policy sends the response body to Azure Content Safety APIs in parallel:

        - `text:analyze` — Evaluates harm categories and checks blocklists

        - `text:detectGroundedness` — Scores the response against the grounding source (when enabled
          and grounding source is available)

        - `text:detectProtectedMaterial` — Detects known copyrighted text (when enabled)

    3.  If the response violates any policies, the policy returns a `403` error code to the client.

    4.  If the response passes, the policy forwards the original response to the client.

3.  **Response Phase — Streaming** (when `moderateStreamingResponse` is enabled):

    1.  The policy installs a stream handler that receives decoded SSE frames.

    2.  Frame bodies are accumulated in a rolling buffer.

    3.  When the buffer reaches `streamingMinBufferChars`, it drains to `text:analyze` (and
        optionally `text:detectProtectedMaterial`).

    4.  If any rule fires, the policy replaces the current frame with a
        `TaskStatusUpdateEvent { state: FAILED }` and closes the stream.

    5.  On clean decisions, frames forward unchanged and the buffer resets.

### Whole-Payload Passing

The policy sends the **raw JSON body** (as bytes) to Azure as the `text` value, not extracted text
parts. This approach provides:

- **Complete coverage** — Adversarial content in any field reaches Azure

- **Simplicity** — No per-schema drift when A2A adds new part kinds

- **Consistency** — Works uniformly across JSON-RPC and HTTP+JSON

> [!NOTE] Azure limits inputs at ~10,000 characters. Larger payloads trigger the `payload_too_large`
> rule.

### Groundedness Detection

Groundedness detection helps detect hallucinations by evaluating whether agent responses are
grounded in the provided reference text. This is particularly useful for RAG (Retrieval-Augmented
Generation) applications.

To enable groundedness detection:

1.  Enable groundedness detection in Advanced Configuration (`enableGroundednessDetection: true`).

2.  Configure the **Grounding Source Selector** to extract the reference text from the request body.

3.  Set the API Version to a preview version that supports the groundedness endpoint (for example,
    `2024-09-15-preview`).

The grounding source selector is a DataWeave expression that extracts the reference text the agent
response should be based on (typically documents or context provided in the request).

Example Configuration

```yaml
advancedConfiguration:
  apiVersion: "2024-09-15-preview"
  enableGroundednessDetection: true
  groundingSourceSelector: "#[payload.params.message.metadata.context]"
```

### Severity Thresholds

Azure AI Content Safety evaluates content across four harm categories and assigns a severity level
to each:

- **0** — Safe (no harmful content detected)

- **2** — Low severity

- **4** — Medium severity

- **6** — High severity

The policy rejects content when the severity level is at or above the configured threshold:

<table><colgroup><col> <col></colgroup><thead><tr><th>Threshold Value</th><th>Content Blocked</th></tr></thead><tbody><tr><td><div><div><p>0</p></div></div></td><td><div><div><p>Any flagged content (severity &gt; 0) is blocked. This is the strictest setting.</p></div></div></td></tr><tr><td><div><div><p>2</p></div></div></td><td><div><div><p>Content with low, medium, or high severity is blocked. This is the recommended default.</p></div></div></td></tr><tr><td><div><div><p>4</p></div></div></td><td><div><div><p>Content with medium or high severity is blocked. This allows low-severity content.</p></div></div></td></tr><tr><td><div><div><p>6</p></div></div></td><td><div><div><p>Only high-severity content is blocked. This is the most permissive setting.</p></div></div></td></tr></tbody></table>

You can configure a default threshold that applies to all categories, and optionally override the
threshold for specific categories.

### Response Headers

Every moderated response includes observability headers:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Header</th><th>Values</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>x-flex-azure-guardrails-action</code></p></div></div></td><td><div><div><p><code>allow</code>, <code>reject</code>, <code>skip</code></p></div></div></td><td><div><div><p>Final moderation decision. <code>reject</code> indicates content violated one or more policies. <code>skip</code> indicates the session was sampled out.</p></div></div></td></tr><tr><td><div><div><p><code>x-flex-azure-guardrails-phase</code></p></div></div></td><td><div><div><p><code>request</code>, <code>response</code>, <code>response_stream</code></p></div></div></td><td><div><div><p>Which phase performed the moderation. Useful for understanding whether the request or response was blocked.</p></div></div></td></tr><tr><td><div><div><p><code>x-flex-azure-guardrails-reason</code></p></div></div></td><td><div><div><p><code>severity_hate</code>, <code>severity_self_harm</code>, <code>severity_sexual</code>, <code>severity_violence</code>, <code>blocklist</code>, <code>prompt_shield</code>, <code>groundedness</code>, <code>protected_material</code>, <code>payload_too_large</code>, <code>streaming_buffer_overflow</code>, <code>service_unavailable</code>, <code>sampled_out</code></p></div></div></td><td><div><div><p>Why the content was rejected or skipped. Multiple reasons are comma-separated if the content violated multiple policies.</p></div></div></td></tr></tbody></table>

Headers are not emitted on gRPC pass-through traffic.

## Response on Reject

When the policy blocks content, it returns a transport-appropriate error response.

### JSON-RPC Transport

HTTP 403 with a JSON-RPC 2.0 error response:

```json
{
  "jsonrpc": "2.0",
  "id": null,
  "error": {
    "code": -32600,
    "message": "Request blocked by Azure Content Safety: severity_violence",
    "data": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "domain": "a2a-protocol.org",
        "reason": "FORBIDDEN",
        "metadata": {
          "detail": "severity_violence"
        }
      }
    ]
  }
}
```

The error code `-32600` maps to the A2A v1.0 `FORBIDDEN` reason code.

### HTTP+JSON Transport

HTTP 403 with a Google RPC Status error response:

```json
{
  "error": {
    "code": 403,
    "status": "PERMISSION_DENIED",
    "message": "Request blocked by Azure Content Safety: severity_violence",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "domain": "a2a-protocol.org",
        "reason": "FORBIDDEN",
        "metadata": {
          "detail": "severity_violence"
        }
      }
    ]
  }
}
```

### Streaming Response

When a streaming response trips a rule mid-stream, the policy replaces the offending frame with a
failed-status event and closes the stream:

```none
event: status-update
data: {"jsonrpc":"2.0","id":"req-2","result":{"taskId":"task-abc","status":{"state":"FAILED","message":{"role":"agent","parts":[{"kind":"text","text":"Response blocked by Azure Content Safety: severity_hate,protected_material"}]}},"isFinal":true}}
```

No further frames are emitted.

## Error Handling

The policy provides two error handling modes to control behavior when Azure API calls fail or
timeout.

Fail Closed (Default)

When **Fail Open** is disabled, any Azure API error or timeout results in rejection with HTTP `503`
and a transport-appropriate error response.

- JSON-RPC Transport:

  ```json
  {
    "jsonrpc": "2.0",
    "id": null,
    "error": {
      "code": -32603,
      "message": "Azure Content Safety service unavailable",
      "data": [
        {
          "@type": "type.googleapis.com/google.rpc.ErrorInfo",
          "domain": "a2a-protocol.org",
          "reason": "UNAVAILABLE",
          "metadata": {
            "detail": "service_unavailable"
          }
        }
      ]
    }
  }
  ```

  The error code `-32603` maps to the A2A v1.0 `UNAVAILABLE` reason code.

- HTTP+JSON Transport:

  ```json
  {
    "error": {
      "code": 503,
      "status": "UNAVAILABLE",
      "message": "Azure Content Safety service unavailable",
      "details": [
        {
          "@type": "type.googleapis.com/google.rpc.ErrorInfo",
          "domain": "a2a-protocol.org",
          "reason": "UNAVAILABLE",
          "metadata": {
            "detail": "service_unavailable"
          }
        }
      ]
    }
  }
  ```

  The `x-flex-azure-guardrails-reason` header is set to `service_unavailable` for both transports.

Fail Open

When **Fail Open** is enabled, Azure API errors are logged but traffic continues without moderation.
The `x-flex-azure-guardrails-reason` header is still set to `service_unavailable` for observability,
allowing you to detect partial-coverage moderation in monitoring systems.

## Example Configurations

The following examples demonstrate common configuration patterns for the A2A v1 Azure Content
Guardrails policy.

### Minimal Configuration — Request and Response Moderation

```yaml
- policyRef:
    name: a2a-v1-azure-guardrails-policy-v1-0-impl
    namespace: default
  config:
    azureEndpoint: https://llmproxy-azure-cs.cognitiveservices.azure.com
    azureApiKey: "${AZURE_CONTENT_SAFETY_KEY}"
```

### 50% Sampling for Cost Control

```yaml
- policyRef:
    name: a2a-v1-azure-guardrails-policy-v1-0-impl
    namespace: default
  config:
    azureEndpoint: https://llmproxy-azure-cs.cognitiveservices.azure.com
    azureApiKey: "${AZURE_CONTENT_SAFETY_KEY}"
    advancedConfiguration:
      samplingRatePercent: 50
```

Half the sessions (bucketed deterministically by `contextId`) are moderated; the other half pass
through with the `sampled_out` observability header.

### Strict Threshold with Blocklists

This example blocks any flagged content and applies custom blocklists:

```yaml
- policyRef:
    name: a2a-v1-azure-guardrails-policy-v1-0-impl
    namespace: default
  config:
    azureEndpoint: https://llmproxy-azure-cs.cognitiveservices.azure.com
    azureApiKey: "${AZURE_CONTENT_SAFETY_KEY}"
    moderateStreamingResponse: false
    defaultSeverityThreshold: 0
    advancedConfiguration:
      blocklistNames:
        - competitor-names
        - internal-codenames
```

### Per-Category Thresholds

This example applies different thresholds to different harm categories:

```yaml
- policyRef:
    name: a2a-v1-azure-guardrails-policy-v1-0-impl
    namespace: default
  config:
    azureEndpoint: https://llmproxy-azure-cs.cognitiveservices.azure.com
    azureApiKey: "${AZURE_CONTENT_SAFETY_KEY}"
    defaultSeverityThreshold: 2
    advancedConfiguration:
      selfHarmSeverityThreshold: "4" # Allow low-severity SelfHarm discussion
      violenceSeverityThreshold: "0" # Block any flagged Violence
```

### With Groundedness Detection (Hallucination Detection)

```yaml
- policyRef:
    name: a2a-v1-azure-guardrails-policy-v1-0-impl
    namespace: default
  config:
    azureEndpoint: https://llmproxy-azure-cs-eastus.cognitiveservices.azure.com
    azureApiKey: "${AZURE_CONTENT_SAFETY_KEY}"
    defaultSeverityThreshold: 4
    advancedConfiguration:
      apiVersion: "2024-09-15-preview"
      enableGroundednessDetection: true
      groundingSourceSelector: "#[payload.params.message.metadata.context]"
      enableProtectedMaterialDetection: true
      blocklistNames:
        - my-blocklist
      apiTimeoutMs: 10000
      streamingMinBufferChars: 512
      failOpen: false
      samplingRatePercent: 25
      sessionKeySelector: "#[payload.params.message.metadata.userId]"
```

## See Also

- [Azure AI Content Safety](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/overview)

- [Prompt Shield](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection)

- [Groundedness Detection](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/groundedness)

- [Azure Content Safety Policy](https://docs.mulesoft.com/gateway/latest/policies-included-azure-content-safety) (for LLM traffic)

- [Agent Policies](https://docs.mulesoft.com/gateway/latest/agent-policies)