Configure content moderation for an agent
Your responsible AI design review asks whether filters protect your agent against harmful content, and content moderation is where you decide how strictly those filters apply. In this unit, you learn how to choose and place a moderation level on the standard and GitHub Copilot harnesses, diagnose a filtered response, and recognize the risks that moderation leaves to other parts of your design.
How platform content filtering works
Copilot Studio enforces content moderation policies on all generative AI requests to help ensure that admins, makers, and users aren't exposed to offensive or harmful material. The same policies also address malicious attempts such as jailbreaking, prompt injection, prompt exfiltration, and copyright infringement. You don't build these checks yourself. Your job is to decide how strict they are and where that strictness applies.
Filtering evaluates content at two points in each exchange:
- User input: The system checks the user's message when it arrives.
- Agent response: The system checks the content again before the agent responds.
If either check detects harmful, offensive, or malicious content, the system blocks the agent from responding. The user sees an error message that reads "The content was filtered due to Responsible AI restrictions," with the error code ContentFiltered.
A filtered response isn't always that visible. On the standard harness, when moderation filters content in a generative answers node, the node returns no answer and gives no indication that moderation was the cause. When a node returns nothing, check whether filtering blocked the answer.
To diagnose a blocked or missing response, find the message that triggered the filter:
- Conversation transcripts: Review the transcript to see which message led to the filtered response.
- Azure Application Insights: On the standard harness, if the agent sends telemetry to Application Insights, query the logged events for
ContentFiltered, across all conversations or for one conversation ID.
For example, if an employee asks your HR policy agent about leave for a medical procedure and gets the filtered message, the transcript shows the message that triggered the filter. You can then judge whether the request was harmful or a legitimate policy question.
What you find determines the fix. When the triggering message is harmful or manipulative, the filter is working as intended, and the remedy is to reinforce responsible use with your users. When the filter blocks legitimate content, adjust the moderation level for the scope that needs it. If you believe the content shouldn't be moderated at all, contact Microsoft customer support.
Moderation settings on each harness
The harness your agent runs on determines where you set moderation and how narrowly you can apply it. On the GitHub Copilot harness, you set one moderation level for the agent. On the standard harness, you can set moderation for the agent, for a generative answers node in a topic, and for a prompt tool.
| Harness | Where you set it | What it applies to | Levels |
|---|---|---|---|
| GitHub Copilot harness | Moderation level on the AI & behavior tab of agent settings | The agent | Minimum, Low, Medium, High, Maximum |
| Standard harness | Generative AI settings page | The agent | Lowest through Highest |
| Standard harness | Properties pane of a generative answers node | That node, at the topic level | Lowest through Highest |
| Standard harness | Prompt builder settings | That prompt | Low, Moderate, High |
The two harnesses use different level names. Choose from each scale on its own terms instead of assuming that a level on one harness matches a level with the same or a similar name on the other.
On the GitHub Copilot harness, the Moderation level setting controls how strictly responses are filtered for unsafe content. Changes to it take effect after you save and publish the agent.
On the standard harness, the three scopes work together:
- Agent level: Sets the baseline for the agent, with a default of High. To adjust it, set the agent's Generative AI option to Generative, which turns on generative orchestration.
- Topic level: A moderation level on a generative answers node takes precedence at runtime for that node. If you don't set one, the node uses the agent level.
- Prompt level: A prompt tool has its own level, with a default of Moderate. This setting applies only to managed models, and it's unavailable when the prompt uses an external model.
To make a prompt's level override the agent or topic level when the agent uses the prompt, open the prompt tool's Completion screen and set After running to Send specific response (specify below). Then include the prompt's output variable, Output.predictionOutput.text, in the Message to display.
Trade-offs between moderation levels
Every moderation level trades answer coverage against risk. Lower levels let the agent return more answers, but those answers might include harmful content. For a prompt, for example, a lower level might allow hate and fairness, sexual, violence, or self-harm content. Higher levels apply a stricter filter that lowers that risk, and they might reduce the number of responses. A lower level might also return answers that are less accurate or relevant, so treat lowering the level as a deliberate exception.
A lower level fits when:
- The agent or prompt legitimately processes content that could be considered harmful, such as descriptions of violence or medical procedures.
- Transcripts show that the filter blocks legitimate requests at the current level.
Place any exception at the narrowest scope that needs it. On the standard harness, you can lower the level on one generative answers node or one prompt tool and leave the agent's baseline unchanged. On the GitHub Copilot harness, Moderation level is an agent-level setting, so lowering it for one task lowers it for the whole agent.
Say your HR policy agent uses a prompt tool that summarizes medical leave documentation. That documentation might describe medical procedures, while general benefits questions contain nothing sensitive. On the standard harness, you can set the prompt to Low, configure the Send specific response (specify below) override, and keep the agent level at High. On the GitHub Copilot harness, you weigh whether a lower level is acceptable for the whole agent.
Risks that moderation doesn't cover
Moderation screens content for harm. It doesn't check whether a request fits your organization's policies. Suppose an employee politely asks your HR policy agent for a coworker's leave balance. The request contains no harmful language, so it passes both checks. What stops it is the rest of your agent's design:
- Instructions: Tell the agent which requests to decline, such as questions about another employee's records.
- Knowledge scope: Limit knowledge to the sources the agent's purpose requires.
- Tools and permissions: Grant each tool only the access its task needs.
The same limit applies to accuracy. An answer drawn from an outdated policy document contains nothing harmful, so moderation lets it through. Current, accurate answers depend on the sources you connect to the agent.
Moderation and guardrails divide the work: moderation handles harmful and malicious content in every conversation, and guardrails handle what's appropriate for your agent's purpose. Guardrail design, later in this module, covers those layers in depth.
Reflect: Think of a request your agent should refuse that contains no harmful language at all. Which part of your agent's design, instead of moderation, would stop it?