为托管智能体添加护栏

/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies/<policy-name>

pip install "azure-ai-projects>=2.2.0"

pip install "azure-ai-projects>=2.7.0"

services:
     my-agent:
       host: azure.ai.agent
       project: src/my-agent
       kind: hosted
       name: my-hosted-agent
       description: A hosted agent with a content safety guardrail
       policies:
      - type: rai_policy
        # Full ARM resource ID of the RAI policy on the Foundry resource.
        raiPolicyName: /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies/<policy-name>
    protocols:
      - protocol: responses
        version: "2.0.0"

azd deploy

from azure.ai.projects import AIProjectClient
from azure.ai.projects.models import (
    AgentEndpointProtocol,
    ContainerConfiguration,
    HostedAgentDefinition,
    ProtocolVersionRecord,
    RaiConfig,
)
from azure.identity import DefaultAzureCredential

# Format: "https://<resource-name>.services.ai.azure.com/api/projects/<project-name>"
PROJECT_ENDPOINT = "your_project_endpoint"

# Full ARM resource ID of the RAI policy.
RAI_POLICY_ID = (
    "/subscriptions/<subscription-id>/resourceGroups/<resource-group>"
    "/providers/Microsoft.CognitiveServices/accounts/<account>"
    "/raiPolicies/<policy-name>"
)

credential = DefaultAzureCredential()
project = AIProjectClient(
    endpoint=PROJECT_ENDPOINT,
    credential=credential,
    allow_preview=True,
)

agent = project.agents.create_version(
    agent_name="my-agent",
    definition=HostedAgentDefinition(
        cpu="1",
        memory="2Gi",
        container_configuration=ContainerConfiguration(
            image="your-registry.azurecr.io/your-image:tag",
        ),
        protocol_versions=[\
            ProtocolVersionRecord(\
                protocol=AgentEndpointProtocol.RESPONSES, version="2.0.0"\
            )\
        ],
        rai_config=RaiConfig(rai_policy_name=RAI_POLICY_ID),
    ),
)

print(f"Agent created: {agent.name}, version: {agent.version}")

using System;
using Azure.AI.Projects.Agents;
using Azure.Identity;

// Format: "https://<resource-name>.services.ai.azure.com/api/projects/<project-name>"
var projectEndpoint = "your_project_endpoint";

// Full ARM resource ID of the RAI policy.
var raiPolicyId =
    "/subscriptions/<subscription-id>/resourceGroups/<resource-group>"
    + "/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies/<policy-name>";

AgentAdministrationClient agentsClient = new(
    endpoint: new Uri(projectEndpoint),
    tokenProvider: new DefaultAzureCredential());

var definition = new HostedAgentDefinition(
    versions: new[] { new ProtocolVersionRecord(ProjectsAgentProtocol.Responses, "2.0.0") },
    cpu: "1",
    memory: "2Gi")
{
    ContainerConfiguration = new ContainerConfiguration("your-registry.azurecr.io/your-image:tag"),
    ContentFilterConfiguration = new ContentFilterConfiguration(raiPolicyName: raiPolicyId),
};
ProjectsAgentVersion agent = agentsClient.CreateAgentVersion(
    agentName: "my-agent",
    options: new ProjectsAgentVersionCreationOptions(definition));
Console.WriteLine($"Agent created: {agent.Name}, version: {agent.Version}");

npm install @azure/ai-projects @azure/identity

import { AIProjectClient } from "@azure/ai-projects";
import { DefaultAzureCredential } from "@azure/identity";

// Format: "https://<resource-name>.services.ai.azure.com/api/projects/<project-name>"
const projectEndpoint =
process.env["FOUNDRY_PROJECT_ENDPOINT"] || "your_project_endpoint";

// Full ARM resource ID of the RAI policy.
const raiPolicyId =
"/subscriptions/<subscription-id>/resourceGroups/<resource-group>" +
"/providers/Microsoft.CognitiveServices/accounts/<account>" +
"/raiPolicies/<policy-name>";

const project = new AIProjectClient(
projectEndpoint,
new DefaultAzureCredential(),
);

const agent = await project.agents.createVersion("my-agent", {
kind: "hosted",
cpu: "1",
memory: "2Gi",
container_configuration: {
    image: "your-registry.azurecr.io/your-image:tag",
},
protocol_versions: [{ protocol: "responses", version: "2.0.0" }],
rai_config: { rai_policy_name: raiPolicyId },
});

console.log(`Agent created: ${agent.name}, version: ${agent.version}`);

BASE_URL="https://{account}.services.ai.azure.com/api/projects/{project}"
API_VERSION="v1"
TOKEN=$(az account get-access-token --resource https://ai.azure.com --query accessToken -o tsv)

curl -X POST "$BASE_URL/agents?api-version=$API_VERSION" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-agent",
    "definition": {
      "kind": "hosted",
      "container_configuration": {
        "image": "myacr.azurecr.io/my-agent:v1"
      },
      "cpu": "1",
      "memory": "2Gi",
      "protocol_versions": [\
        {"protocol": "responses", "version": "2.0.0"}\
      ],
      "rai_config": {
        "rai_policy_name": "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies/<policy-name>"
      }
    }
}'

curl -s -X GET "$BASE_URL/agents/my-agent/versions/1?api-version=$API_VERSION" \
  -H "Authorization: Bearer $TOKEN" | jq '.definition.rai_config'

{
  "rai_policy_name": "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies/<policy-name>"
}

curl -i -X POST "$BASE_URL/agents/my-agent/endpoint/protocols/openai/responses?api-version=$API_VERSION" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"input":"<a prompt that your policy is configured to block>","store":true}'

{
  "error": {
    "code": "content_filter",
    "message": "The request was blocked due to content safety policy violation at input stage.",
    "type": "content_safety_error"
  }
}

az rest --method get \
     --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies?api-version=2024-10-01" \
     --query "value[].name" -o tsv

services:
     my-agent:
       host: azure.ai.agent
       project: src/my-agent
       kind: hosted
       name: my-hosted-agent
       policies:
      - type: rai_policy
        raiPolicyName: /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies/<policy-name>
        invocationsModeration:
          responseMode: streaming
          inputPaths:
            - $.message
          streamSelectors:
            - eventType: token
              textField: content
            - eventType: done
              textField: full_text
    protocols:
      - protocol: invocations
        version: "2.0.0"

azd deploy

policies[0] invocationsModeration is only supported for agents that expose the 'invocations' protocol; add it to 'protocols' or remove the moderation block

from azure.ai.projects.models import (
    RaiConfig,
    RaiInvocationMode,
    RaiInvocationModeration,
    RaiSseTextSelector,
)

rai_config = RaiConfig(
    rai_policy_name=RAI_POLICY_ID,
    invocations_moderation=RaiInvocationModeration(
        response_mode=RaiInvocationMode.STREAMING,
        input_paths=["$.message"],
        stream_selectors=[\
            RaiSseTextSelector(event_type="token", text_field="content"),\
            RaiSseTextSelector(event_type="done", text_field="full_text"),\
        ],
    ),
)

{
"name": "my-agent",
"definition": {
    "kind": "hosted",
    "container_configuration": {
      "image": "myacr.azurecr.io/my-agent:v1"
    },
    "cpu": "1",
    "memory": "2Gi",
    "protocol_versions": [\
      {"protocol": "invocations", "version": "2.0.0"}\
    ],
    "rai_config": {
      "rai_policy_name": "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies/<policy-name>",
      "invocations_moderation": {
        "response_mode": "streaming",
        "input_paths": ["$.message"],
        "stream_selectors": [\
          {"event_type": "token", "text_field": "content"},\
          {"event_type": "done", "text_field": "full_text"}\
        ]
      }
    }
}
}

curl -s -X GET "$BASE_URL/agents/my-agent/versions/1?api-version=$API_VERSION" \
  -H "Authorization: ******" | jq '.definition.rai_config.invocations_moderation'

{
  "error": {
    "code": "content_filter",
    "message": "The request was blocked due to content safety policy violation at input stage. [Request ID: <request-id>]",
    "type": "content_safety_error"
  }
}

event: error
data: {"type":"error","code":"content_filter","message":"The response was blocked due to content safety policy violation."}

{
  "message": "<a prompt that your policy is configured to block>"
}

azd ai agent invoke -f blocked-request.json

curl -i -X POST "$BASE_URL/agents/my-agent/endpoint/protocols/invocations?api-version=$API_VERSION" \
  -H "Authorization: ******" \
  -H "Content-Type: application/json" \
  -d '{"message":"<a prompt that your policy is configured to block>"}'

@description('Name of the existing Foundry resource.')
param accountName string

resource account 'Microsoft.CognitiveServices/accounts@2026-05-15-preview' existing = {
     name: accountName
}

resource egressPolicy 'Microsoft.CognitiveServices/accounts/raiPolicies@2026-05-15-preview' = {
     parent: account
     name: 'allow-contoso'
     properties: {
       mode: 'Blocking'
       basePolicyName: 'Microsoft.DefaultV2'
       egressPolicy: {
         mode: 'Enforced'
         defaultAction: 'Deny'
         rules: [\
           {\
             name: 'allow-contoso'\
             ruleType: 'Fqdn'\
             match: {\
               host: '*.contoso.com'\
             }\
             action: {\
               actionType: 'Allow'\
             }\
           }\
         ]
       }
     }
}

output RAI_POLICY_ID string = egressPolicy.id

azd provision

TOKEN=$(az account get-access-token --resource "https://management.azure.com" --query accessToken -o tsv)

curl -X PUT \
  "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<account>/raiPolicies/<policy-name>?api-version=2026-05-15-preview" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "properties": {
      "mode": "Blocking",
      "basePolicyName": "Microsoft.DefaultV2",
      "egressPolicy": {
        "mode": "Enforced",
        "defaultAction": "Deny",
        "rules": [\
          {\
            "name": "allow-contoso",\
            "ruleType": "Fqdn",\
            "match": { "host": "*.contoso.com" },\
            "action": { "actionType": "Allow" }\
          }\
        ]
      }
    }
  }'

{
  "mode": "Audit",
  "defaultAction": "Deny",
  "rules": [\
    {\
      "name": "allow-pypi-metadata",\
      "ruleType": "Fqdn",\
      "match": { "host": "pypi.org" },\
      "action": { "actionType": "Allow" }\
    },\
    {\
      "name": "allow-python-package-downloads",\
      "ruleType": "Fqdn",\
      "match": { "host": "files.pythonhosted.org" },\
      "action": { "actionType": "Allow" }\
    },\
    {\
      "name": "allow-github-api",\
      "ruleType": "Fqdn",\
      "match": { "host": "api.github.com" },\
      "action": { "actionType": "Allow" }\
    }\
  ]
}

{
  "name": "allow-and-tag-contoso",
  "ruleType": "Fqdn",
  "match": { "host": "*.contoso.com" },
  "action": {
    "actionType": "Transform",
    "headers": [\
      { "operation": "Set",    "name": "X-Trace-Source", "value": "hosted-agent" },\
      { "operation": "Insert", "name": "X-Request-Id",   "value": "default-id" },\
      { "operation": "Remove", "name": "User-Agent" }\
    ]
  }
}

import os
import requests

response = requests.get(
    "https://example.com",
    verify=os.environ["REQUESTS_CA_BUNDLE"],
)

cat "$SSL_CERT_FILE" /app/custom-roots.pem > /tmp/runtime-ca-bundle.pem
export SSL_CERT_FILE=/tmp/runtime-ca-bundle.pem
export REQUESTS_CA_BUNDLE=/tmp/runtime-ca-bundle.pem

traces
| where timestamp > ago(1h)
| where message == "Network egress decision"