> For the complete documentation index, see [llms.txt](https://dyns.ntd.asia/power-dynamics/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dyns.ntd.asia/power-dynamics/artificial-intelligence/study-copilot-studio/enterprise-integration-and-governance/responsible-ai-principles-safety-filters-and-human-oversight.md).

# Responsible AI: Principles, Safety Filters, and Human Oversight

Copilot Studio Session 7.2: the four-vs-six responsible AI principles conflict, content moderation levels, ContentFiltered, and human oversight for prompts.

*Group 7 — Enterprise Integration & Governance · Session 7.2 of 4*

7.1 named the identity and access-control infrastructure sitting underneath Northwind's five agent connections. This session asks a different question. Once an agent is authenticated, identified, and walled off by the right data policy, what stops it from saying something harmful, fabricated, or biased? Microsoft's answer isn't one mechanism — it's three: design principles makers are supposed to build against, a content-safety filter that runs whether or not anyone remembers those principles, and a documented expectation that a human keeps checking the output.

{% hint style="info" %}
Three layers, not one: **principles** a maker applies by choice, a **content filter** that runs automatically on every generative request regardless, and a **human-oversight expectation** that, for the Prompt tool specifically, turns out to be a recommendation rather than a configurable gate. Plus one document that ties all three together for the whole platform: the Application Card.
{% endhint %}

## How many "core principles" does Copilot Studio actually have?

Researching this session turned up a real documentation inconsistency — the same shape of finding as 6.3's harness pages and 6.4's Fabric fork. This time it isn't a naming collision or a preview-feature split. It's two Microsoft Learn pages naming a different number of "core" responsible AI principles for the same product.

The guidance page written for people building agents in Copilot Studio says it plainly, under a heading called "Core principles of responsible AI": *"Responsible AI core principles include fairness, accountability, transparency, and ethics."* \[1] Four items, no hedging, presented as the list.

The Application Card — Copilot Studio's own system-level transparency document — describes itself as putting into practice *"Microsoft's six core responsible AI principles: fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability."* \[2] That six-item list matches Microsoft's company-wide AI principles page word for word \[3] — the standard everything else is supposed to trace back to.

| Appears in guidance/responsible-ai's 4 | Appears in the Application Card's 6 | Verdict                          |
| -------------------------------------- | ----------------------------------- | -------------------------------- |
| Fairness                               | Fairness                            | In both lists                    |
| Transparency                           | Transparency                        | In both lists                    |
| Accountability                         | Accountability                      | In both lists                    |
| Ethics                                 | —                                   | Only in the 4-item guidance page |
| —                                      | Reliability and safety              | Only in the canonical 6          |
| —                                      | Privacy and security                | Only in the canonical 6          |
| —                                      | Inclusiveness                       | Only in the canonical 6          |

Four and six aren't a rounding difference. So which one do you build against? Treat the six-item list as canonical: it's the company standard, it's what the platform's own transparency document cites by name, and each term points at something concrete you can act on — "privacy and security," for instance, is the encryption and RBAC content 7.1 already covered under identity. The guidance page's four-item version reads more like one team's working checklist than a competing definition of the principles, and treating it as the whole list would mean quietly dropping reliability/safety, privacy/security, and inclusiveness from what you design toward. Both lists exist in Microsoft's own docs. Only one of them is worth building around.

## The filter that runs whether or not you remember the principles

Design principles are something a maker chooses to apply. Underneath them, Copilot Studio runs an actual technical filter on every generative request whether anyone chose anything or not: content moderation, backed by [Azure AI Content Safety](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/overview), checked twice per turn — once on what the user typed, once on what the agent is about to say back. \[4] If either check flags something, the system blocks it and shows the end user an error: *"The content was filtered due to Responsible AI restrictions,"* error code `ContentFiltered`. By name, the filter watches for jailbreaking, prompt injection, prompt exfiltration, and copyright infringement, plus — through Azure AI Content Safety's harm scanners — hate and unfairness, sexual content, violence, and self-harm. \[4]

For the Prompt tool specifically — the one 4.3 taught as a single-turn, model-based tool — a maker gets a direct lever over this: a content moderation level slider in the prompt builder's settings, behind the three-dot menu, running Low to High and defaulting to Moderate. \[5]\[6] It only works for managed models. Pick Anthropic or an Azure AI Foundry model instead and the slider disables, because the moderation is tied to Azure OpenAI's own managed-model stack, not something Copilot Studio can attach to a third-party model. \[6]

Read the three levels' actual wording slowly, because it's easy to get backwards:

| Level              | What it means                                                                                                                                              | Suggested use                                                                                           |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| Low                | "Might allow hate and fairness, sexual, violence, or self-harm content that displays explicit and severe harmful instructions, actions, damage, or abuse." | Prompts processing content that's inherently about harm — descriptions of violence, medical procedures. |
| Moderate (default) | "Might allow ... content that uses offensive, insulting, mocking, intimidating, or demeaning language towards specific identity groups."                   | Default filtering, appropriate for most uses.                                                           |
| High               | "Might allow ... content that expresses prejudiced, judgmental, or opinionated views."                                                                     | Use when Moderate still isn't restrictive enough.                                                       |

Read forward, "High" sounds like the setting that lets more through. It's the opposite. Each level names the most severe content that level will still let slip past. At Low, even explicit, severe harm can get through undetected. At High, only mild, opinion-level content might slip through, because the filter is catching everything more severe than that. The docs state the tradeoff plainly: lower moderation raises the risk of harmful content reaching a response, higher moderation lowers that risk but can also block legitimate answers. \[6] Microsoft names the reason this setting exists at all — law enforcement and medical-assessment prompts, which sometimes need to discuss content a default filter would otherwise catch. \[5]

## Human oversight, recommended but not built

4.2 gave autonomous and semi-autonomous flows a buildable human checkpoint: Request Information or Approval, wired into a flow with Asynchronous response so the agent could wait on a real person before continuing. That's a mechanism you configure, publish, and test.

The responsible-AI guidance for the Prompt tool doesn't have an equivalent. What it has is a stated expectation. Two risks are named as the reason for it: **prompt injection**, where a third party smuggles instructions into content the model processes — say, a customer review field written to make a summarization prompt say what the reviewer wants said — and **fabrication**, Microsoft's own term for a model inventing information that was never in its inputs. \[7] Microsoft's response to both is direct: *"We acknowledge these risks and reaffirm our commitment to human oversight and control,"* followed by a recommendation that makers *"implement meaningful human oversight within their flows and apps"* and test prompts specifically for their potential to produce harmful or prohibited output. \[7]

{% hint style="warning" %}
**A recommendation, not a gate.** What's missing from that same documentation is any setting that enforces the oversight — no toggle, no required approval step, nothing to publish. It's aimed at the maker's judgment, not a gate the platform enforces. That's a real difference from 4.2's flow-level approval step, worth stating plainly rather than assuming a hidden setting must exist somewhere: for the Prompt tool, human review is something you design in yourself, the same way 5.2 built its deterministic guardrail by choosing not to wire in a delete action at all.
{% endhint %}

The Application Card widens this into end-user guidance that reaches past prompts specifically. Users are told to *"exercise human oversight when appropriate"* and warned about **overreliance**: accepting incorrect or incomplete AI output because the mistake is hard to spot. \[2] The Card also names where this stops being optional advice: sensitive domains where *"agent actions are irreversible or highly consequential"* — finance and insurance, healthcare, legal service, essential government service, employment, education, or housing. \[2]

## The Application Card, underneath all of it

The Application Card — sometimes called the Platform Card on Microsoft's own overview page, same document, two names in circulation across their docs \[2]\[8] — is Copilot Studio's system-level transparency filing: what the product is, how it's meant to be used, where it falls short, and what Microsoft tested before shipping it.

Two parts of it matter here. First, the evaluation methodology: internal testing measures four quality metrics (groundedness, coherence, fluency, similarity) against nine named risk-and-safety harm categories using automated pipelines and LLM-based judges: \[2]

* Hate and unfairness
* Sexual
* Violence
* Self-harm
* Protected material
* Indirect jailbreak
* Direct jailbreak
* Code vulnerability
* Ungrounded attributes

Four of those nine categories are the exact ones named in the content-moderation-level descriptions above. The Application Card is describing the same safety system from the measurement side that the moderation-level docs describe from the configuration side.

Second, the limitations section doesn't soften the point: *"Despite responsible AI controls, AI-generated content might still reflect biases, stereotypes, or ungrounded information. Users should always review responses and actions, especially in sensitive or high-stakes scenarios."* \[2] That's the same message as the human-oversight guidance above, restated as a documented limitation instead of a recommendation. The filters and principles above reduce risk. They don't remove it.

{% stepper %}
{% step %}

### Open the prompt builder

On any Prompt tool (4.3). Select the three dots (…) at the top of the builder.
{% endstep %}

{% step %}

### Select Settings

The Content moderation level slider sits alongside Temperature, Record retrieval, and the code-interpreter toggle — visible only for managed models. \[6]
{% endstep %}

{% step %}

### Choose Low, Moderate, or High

Moderate is the default and fits most uses. Only move off it for a documented reason — content that's inherently about harm (Low), or a need for more restrictive filtering than Moderate provides (High).
{% endstep %}
{% endstepper %}

## Applying it to Northwind

Northwind's Prompt tool from 4.3 turns the eligibility check's raw output (`eligible: true, reason: within_30_days`) into a plain-language sentence a customer actually reads. That's the exact shape of prompt this session's safety mechanisms exist for: it touches customer-supplied content — the return reason a customer typed in — and produces text a customer sees directly.

Two decisions follow from what got verified this session. First, the content moderation level: Northwind leaves it at the Moderate default instead of lowering it. Nothing about a returns-explanation prompt matches the two documented reasons to lower it — law enforcement or medical assessment — so there's no case for accepting Low's extra risk. Second, human oversight: there's no configured review gate on this specific prompt today, no Request Information step sitting between "prompt drafts the message" and "customer reads it," the way 4.5's build put an Approval step in front of a refund decision.

| Northwind mechanism                                                                | Kind of gate                             | Session                        |
| ---------------------------------------------------------------------------------- | ---------------------------------------- | ------------------------------ |
| Return-approval agent flow (Request information / Approval, Asynchronous response) | Configured, buildable, testable          | 4.2, wired into a build in 4.5 |
| Returns-explanation prompt's "human oversight"                                     | Recommended practice, no platform toggle | 7.2 (this session)             |

That's a genuine gap this session is naming, not quietly fixing. A returns-explanation prompt handles lower-stakes text generation — an explanation rather than a refund transaction — which is a real reason it might not need 4.5's gate. But that's a judgment call Northwind's team would have to make on purpose. Today's build hasn't made it.

## Check your retrieval

{% tabs %}
{% tab title="Question 1 of 4" icon="circle-question" %}
Two Microsoft Learn pages describe Copilot Studio's "core responsible AI principles" differently. What's the actual discrepancy?
{% endtab %}

{% tab title="Answer" icon="unlock" %}
**One page lists 4 principles (fairness, accountability, transparency, ethics); the other cites Microsoft's canonical 6 (adding reliability and safety, privacy and security, inclusiveness — and dropping ethics).** Fairness, transparency, and accountability appear in both; ethics appears only in the 4-item list.
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="Question 2 of 4" icon="circle-question" %}
A maker assumes "High" content moderation is the setting that lets the most content through, since it sounds least restrictive at first glance. Why is that backwards?
{% endtab %}

{% tab title="Answer" icon="unlock" %}
**Each level names the most severe content that level will still let slip past — at High, only mild, opinion-level content might get through, because the filter is catching everything more severe than that.** Higher moderation lowers risk but can also block more legitimate answers.
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="Question 3 of 4" icon="circle-question" %}
How does Copilot Studio's responsible-AI content filter actually evaluate a generative request?
{% endtab %}

{% tab title="Answer" icon="unlock" %}
**Twice — once on the user's input, once on the agent's response before it's delivered.** Either stage can trigger the ContentFiltered error.
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="Question 4 of 4" icon="circle-question" %}
How does "human oversight" for the Prompt tool differ from 4.2's Request Information / Approval mechanism in an agent flow?
{% endtab %}

{% tab title="Answer" icon="unlock" %}
**4.2's mechanism is a configurable, buildable, testable flow step; the Prompt tool's human-oversight guidance is a documented recommendation with no described platform toggle to enforce it.** It's aimed at the maker's judgment, not a platform-enforced control.
{% endtab %}
{% endtabs %}

## The full picture

```mermaid
flowchart TD
    U["User input"] --> E1{"Input evaluation<br/>(Azure AI Content Safety)"}
    E1 -->|"flagged"| B1["Blocked —<br/>ContentFiltered error"]
    E1 -->|"passes"| M["Model generates response<br/>(Prompt tool, 4.3)"]
    M --> E2{"Output evaluation<br/>(Azure AI Content Safety)"}
    E2 -->|"flagged"| B2["Blocked —<br/>ContentFiltered error"]
    E2 -->|"passes"| D["Response delivered<br/>to end user"]
    L["Content moderation level<br/>Low / Moderate / High"] -.->|"sets the threshold for"| E1
    L -.->|"sets the threshold for"| E2
    H["Human oversight<br/>(recommended, not enforced)"] -.->|"no platform gate —<br/>maker's own design"| D
    P["Design principles<br/>(4-vs-6 conflict, above)"] -.->|"guide the maker,<br/>not the filter"| M
```

{% hint style="success" %}
**Key takeaway.** Copilot Studio's responsible-AI story runs on three separate layers, not one — design principles a maker applies by choice (and Microsoft's own docs disagree on how many there are), a content-safety filter Azure AI Content Safety runs automatically on every turn regardless, and a human-oversight expectation for prompts that's currently a recommendation, not a configurable gate.
{% endhint %}

## Reflection

<details>

<summary>The Application Card's limitations section says AI-generated content "might still reflect biases, stereotypes, or ungrounded information" despite responsible AI controls, and separately tells end-users to exercise human oversight. If the platform already runs an automatic content-safety filter on every turn, why would Microsoft still put the responsibility for catching bad output back on the human?</summary>

{% hint style="info" %}
**ONE REASONABLE ANSWER** The filter and human oversight are catching different kinds of failure. The content-safety filter is built to catch the categories it was trained to recognize — hate, sexual content, violence, self-harm, jailbreak attempts — the nine harm categories the Application Card names. Bias, stereotyping, and ungrounded-but-otherwise-harmless content don't reliably trip those categories; a confidently wrong but polite answer, or a subtly biased one, can pass every automated check and still be wrong. The filter is a floor against the most severe and most detectable harms, not a guarantee of correctness or fairness. Human oversight is what's left to catch what the filter was never built to catch — which is exactly why the Card frames it as a persistent responsibility rather than a temporary gap that a future filter update will close.
{% endhint %}

</details>

**Read next:** [FAQ for prompts](https://learn.microsoft.com/en-us/microsoft-copilot-studio/faq-prompts) — the responsible-AI FAQ scoped specifically to the Prompt tool: the Azure AI Content Safety attribution, the Code of Conduct restriction, the "customer data isn't used to train foundation models" answer, and the face-blurring behavior for images submitted through prompt builder.

1. \[1] [Apply responsible AI principles](https://learn.microsoft.com/en-us/microsoft-copilot-studio/guidance/responsible-ai) — the four-item "core principles" list (fairness, accountability, transparency, ethics), data privacy and security practices, bias awareness and mitigation, ongoing monitoring.
2. \[2] [Application Card for Microsoft Copilot Studio](https://learn.microsoft.com/en-us/microsoft-copilot-studio/system-service-card-copilot-studio) — the six-principle framing, intended uses, limitations, the nine risk-and-safety evaluation categories, safety components, and end-user human-oversight guidance.
3. \[3] [Microsoft's responsible AI principles and approach](https://www.microsoft.com/en-us/ai/principles-and-approach) — the canonical six-pillar company standard the Application Card cites by name.
4. \[4] [Resolve responsible AI content filter errors](https://learn.microsoft.com/en-us/troubleshoot/power-platform/copilot-studio/generative-answers/agent-response-filtered-by-responsible-ai) — the ContentFiltered error, the dual input/output evaluation, and the categories the filter watches for by name.
5. \[5] [Configure content moderation level for prompts](https://learn.microsoft.com/en-us/power-platform/release-plan/2025wave2/microsoft-copilot-studio/configure-content-moderation-level-prompts) — the GA release note naming why the setting exists (law enforcement, medical-assessment use cases).
6. \[6] [Change the model version and settings](https://learn.microsoft.com/en-us/microsoft-copilot-studio/prompt-model-settings) — where the slider lives in the UI, the exact Low/Moderate/High wording, and the managed-models-only limitation.
7. \[7] [Human review for automation with a prompt](https://learn.microsoft.com/en-us/microsoft-copilot-studio/azure-openai-human-review) — prompt injection and fabrication risks, and Microsoft's stated commitment to human oversight.
8. \[8] [Platform Card and Responsible AI FAQs for Copilot Studio](https://learn.microsoft.com/en-us/microsoft-copilot-studio/responsible-ai-overview) — the "Platform Card" naming used alongside "Application Card," and the list of nine AI-driven features with their own dedicated FAQs.