_AzureContentSafetyBaseMiddleware| Name | Type | Description |
|---|---|---|
endpoint | Optional[str] | Default: NoneAzure Content Safety resource endpoint URL. Falls back to
the |
credential | Optional[Any] | Default: NoneAzure credential. Accepts a
:class: |
project_endpoint | Optional[str] | Default: None |
exit_behavior | Literal['error', 'continue', 'replace'] | Default: 'error' |
violation_message | Optional[str] | Default: None |
apply_to_input | bool | Default: True |
apply_to_output | bool | Default: False |
name | str | Default: 'azure_prompt_shield' |
context_extractor | Optional[Callable[[AgentState[Any], Runtime[Any]], Optional[PromptShieldInput]]] | Default: None |
| Name | Type |
|---|---|
| endpoint | Optional[str] |
| credential | Optional[Any] |
| project_endpoint | Optional[str] |
| exit_behavior | Literal['error', 'continue', 'replace'] |
| violation_message | Optional[str] |
| apply_to_input | bool |
| apply_to_output | bool |
| name | str |
| context_extractor | Optional[Callable[[AgentState[Any], Runtime[Any]], Optional[PromptShieldInput]]] |
Build a NonStandardAnnotation for prompt injection evaluations.
AgentMiddleware that detects prompt injection using Azure AI Content Safety.
Prompt shield protects agents from adversarial inputs designed to hijack the agent's behavior. Two types of injection are detected:
user_prompt in the API).documents in the API), such as web
search results, retrieved knowledge-base chunks, or email bodies.The middleware extracts the last HumanMessage as the user prompt. Any
ToolMessage items in the state (tool/function outputs) are forwarded to
the API as documents so indirect injection via tool results is also caught.
When an injection attack is detected, the middleware takes one of two actions:
"error" – raises :exc:ContentSafetyViolationError, halting the graph."continue" – replaces the offending message with a violation notice
(either a service-derived description or a custom violation_message)
and lets execution proceed.Note:
apply_to_output defaults to False because prompt injection is
an input-side attack. Set it to True if you want to screen AI
output as well.
Both synchronous (before_agent / after_agent) and asynchronous
(abefore_agent / aafter_agent) hooks are implemented.
Azure AI Foundry project endpoint URL (e.g.
https://<resource>.services.ai.azure.com/api/projects/<project>).
Falls back to the AZURE_AI_PROJECT_ENDPOINT environment variable.
Mutually exclusive with endpoint.
What to do when an injection is detected. One of "error"
(default) or "continue".
Custom text used to replace the offending message
when exit_behavior="continue". Defaults to a message built
from the service response.
Whether to screen the agent's input (last
HumanMessage). Defaults to True.
Whether to screen the agent's output (last
AIMessage). Defaults to False.
Node-name prefix used when wiring this middleware into a
LangGraph. Defaults to "azure_prompt_shield".
Optional callable with signature
(state, runtime) -> Optional[PromptShieldInput]
that receives the current graph state and the LangGraph
:class:~langchain.agents.middleware.Runtime execution context,
and returns the user prompt and documents to screen, or None
to skip evaluation entirely. When None (default) the
middleware uses its built-in extraction logic.