An organization deploys Azure AI Content Safety to moderate user inputs to a consumer-facing AI application. The content safety API returns categories including Hate, Violence, Sexual, and SelfHarm with severity levels 0-6. The security team must configure the application to block any content with Violence severity 4 or higher while allowing Violence severity 0-2 for general users, but allow all violence categories up to severity 6 for verified security researchers. How should this be implemented?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you use one Azure AI Content Safety resource and let your application decide what to block. It reads the Violence severity score, checks whether the caller is a verified security researcher or a general user, and applies the right threshold. That keeps policy enforcement flexible without duplicating resources.
Full Explanation
The correct approach is to use a single Azure AI Content Safety resource and implement application-layer routing that applies different severity thresholds based on the authenticated user's role. Azure AI Content Safety returns severity scores for each category in the API response; the threshold decision (block/allow) can be implemented in the calling application code rather than in the Content Safety service itself. The application can check the authenticated user's role (security researcher vs. general user) and apply the appropriate severity threshold to the Violence category score returned by Content Safety, allowing differentiated policy enforcement from a single Content Safety resource. Creating two separate Azure AI Content Safety resources with different content filter configurations for general users and security researchers is incorrect because it is wasteful and complex to manage when application-layer threshold logic achieves the same result. Configuring Azure API Management policies to apply different content safety severity thresholds per API subscription tier is incorrect because APIM policies can route and transform requests but cannot easily implement per-user-role content safety threshold logic based on AI safety scores returned in responses. Deploying Azure OpenAI content filtering with two separate model deployments for researchers and general users is incorrect because Azure OpenAI content filtering applies at the model deployment level for all users of that deployment; per-user differentiated filtering requires application-layer logic.