4.1. Implement Security for AI

💡 First Principle: An AI agent doesn't just process data on request — it can read across systems on a user's behalf, take autonomous multi-step actions, and be manipulated through the content it processes rather than through a conventional exploit. That combination means AI security needs its own control set, not a repurposed version of application security.

This is the single biggest content delta between SC-500 and AZ-500, and if you're coming from an AZ-500 background, expect this section to feel the least familiar of anything in this guide — treat that as expected, not a personal knowledge gap.

Mental model: three new risk categories run through this whole section — oversharing (AI surfaces content a user technically could reach but would never have found), agent identity risk (what an agent's credentials can reach if compromised — its blast radius), and behavioral risk (prompt injection or jailbreak attempts that manipulate what the AI does from inside its own input).

⚠️ Common Misconception: Guardrails configured in Microsoft Foundry are not equivalent to network-level security controls. Guardrails govern model and agent behavior — content filtering, prompt-injection mitigation — at the application layer. They don't replace network isolation, identity controls, or the traffic-level protections the AI Gateway provides in API Management.