Content Filtering in the Generative AI Hub

Two providers, applied where you choose

Why it matters

• A red-team exercise built only from system-role jailbreak prompts will pass cleanly since August 2026 — not because the defense is strong, but because Prompt Shield no longer evaluates that role at all.
• Client code that checks HTTP status alone will ship with silent blank answers whenever the output filter fires, since a filtered output is a 200, not an error.
• Stacking Azure Content Safety and Llama Guard 3 on both directions quietly quadruples the filtering bill per request — a detail that belongs in any cost estimate next to the model call itself.

Key points

• Two providers: Azure Content Safety (Hate/Violence/Sexual/SelfHarm at 0/2/4/6, Prompt Shield, protected-code detection) and Llama Guard 3 (14 boolean categories).
• Each filter type once per direction; different types run concurrently; orchestration waits for all to complete.
• Prompt Shield runs before harm classification when both are configured; a detected attack skips harm classification entirely.
• Since August 2026, Prompt Shield ignores system and developer role content.
• Input filter rejection = HTTP 400, no model tokens consumed. Output filter block = HTTP 200 with finish_reason: content_filter, not an error.
• Every Azure OpenAI model carries a non-configurable global filter blocking severity 4 and 6 regardless of your thresholds.
• Each configured filter type is billed as a separate request — stacking providers and directions multiplies cost.
• Azure Content Safety has automatic regional fallback on service unavailability; Protected Material Detection for Code only catches code published before its knowledge cutoff.

Terms used on this page

Harm classification

Azure Content Safety's severity scoring (0/2/4/6) of Hate, Violence, Sexual and SelfHarm content.

Prompt Shield

Azure Content Safety's prompt-attack detector; since August 2026 it ignores system and developer role content.

Protected Material Detection for Code

An output-only Azure Content Safety check for generated code matching public GitHub repositories up to a knowledge cutoff.

Llama Guard 3

A 14-category boolean hazard classifier (llama_guard_3_8b); only requested categories are enforced by orchestration.

finish_reason: content_filter

The field signalling an output-filter block; the HTTP status is still 200.

Global content filter (Azure OpenAI)

A platform-level filter on every Azure OpenAI model that blocks severity 4/6 content independent of your own thresholds.

Sources

1. SAP AI Core docs (SAP-docs GitHub, Sep 2026) — Content Filtering (Azure Content Safety, Prompt Shield, protected material, Llama Guard 3, billing note)
2. SAP AI Core docs — Enhancing Model Consumption with Input Filtering (request/response example, 400 on rejection)
3. SAP AI Core docs — Enhancing Model Consumption with Output Filtering (finish_reason content_filter)
4. Microsoft Learn — Azure AI Content Safety, harm categories (primary source for the Hate/Violence/Sexual/SelfHarm 0/2/4/6 scale)
5. Microsoft Learn — Azure AI Content Safety, jailbreak (Prompt Shield) detection
6. Microsoft Learn — Azure AI Content Safety, Protected Material Detection for Code quickstart
7. Meta (PurpleLlama, GitHub) — Llama Guard 3 8B model card, hazard taxonomy and policy (Meta's own primary source)
8. GitHub SAP-docs — Enhancing model consumption with input filtering, earlier revision (SAP-authored mirror)
9. SAP Help Portal — Generative AI hub orchestration service overview (pipeline context for the filtering module)
10. SAP News Center — Secure AI agents: how SAP and NVIDIA co-define enterprise-grade agent execution (OpenShell, the separate agent-action governance layer)
11. SAP News Center — Autonomous enterprise: SAP AI agents at scale (AI Governance Assistant, EU AI Act/NIST risk classification, 2026-09-22)
12. Quickstart: Detect prompt attacks with Prompt Shields — Microsoft Learn (2026)
13. Prompt Shields in Microsoft Foundry (classic) — Microsoft Learn (Aug 2026)
14. Llama Guard (Llama Guard 3, S1-S14 hazard categories) — Mozilla.ai any-guardrail docs