04 | November | 2026 | Deepak Kaushik -> Cloud Blooded Beast

An accounts-payable assistant retrieves a supplier invoice, extracts the payment terms, and prepares an exception report. Buried in the invoice is a request to send the report to a new external address. The document arrived through an approved connector. Its instructions still have no authority to change the workflow.

For enterprise teams building with Microsoft Foundry and Azure AI, this is an architecture decision: where can external text influence a model, and where can that influence become a business action? Prompt injection detection is useful. The application also needs enforceable boundaries around what it reads, discloses, and changes.

Separate detection from permission

Microsoft’s July 29, 2025 security analysis describes prevention, detection, and impact mitigation as complementary defenses. That distinction should shape the design review. A classifier estimates whether text contains an attack. An authorization check decides whether a particular principal may perform a particular operation on a particular resource.

A negative detection result must never become permission to email an arbitrary recipient, read a different customer’s records, or execute unrestricted code. Keep the authenticated user, tenant, permitted records, and approved destinations in application-controlled state. Retrieved prose can supply evidence; it cannot grant itself authority.

This extends the operating responsibilities discussed in the agent governance guide. Here the narrower concern is whether malicious content can cross from evidence into execution.

Understand which Azure AI control is in the request path

Microsoft’s June 5, 2025 Prompt Shields announcement established the product context: detecting direct attacks in user input and indirect attacks in external content. The Prompt Shields documentation, updated October 14, 2026, makes an important integration distinction. Foundry can block inputs when blocking is configured; the standalone Azure AI Content Safety API returns detection results that the application must act on.

For a custom retrieval pipeline, document the path from Azure AI Search or another source through text extraction, scanning, prompt construction, model execution, and tool invocation. Mark the exact content scanned. If the application later adds an attachment, fetches another page, or appends a tool response, that content needs its own assessment.

The same documentation identifies document scanning at supported agent tool-response intervention points as preview. It also labels Spotlighting preview, off by default, and available only through Chat Completions. Do not assume equivalent coverage for every model API, tool, or agent runtime. Confirm the supported path and regional availability before making the control a release dependency.

Read the benchmarks as experiments

Microsoft researchers’ March 20, 2024 Spotlighting paper tested a synthetic corpus of 1,000 documents containing keyword-redirection attacks. With the June 2023 GPT-3.5-Turbo model at temperature 1.0, encoding-based Spotlighting produced attack success rates of 0.0% for document summarization and 1.8% for document question answering. Those are separate task results, not an enterprise-wide protection rate. The paper also reports impaired task performance when that model had to decode encoded text.

The practical lesson is to evaluate security and task quality together. A transformation that prevents a malicious instruction from working may also prevent the assistant from correctly understanding a legitimate invoice. Zero observed successes in one experiment does not establish zero residual risk.

A different April 15, 2025 study by Mindgard and Lancaster University researchers reported 71.98% average prompt-injection evasion against the Azure Prompt Shield service they tested using character perturbations. Their setup used 476 prompt-injection examples, treated Azure as a black-box detector, and placed guardrails before GPT-4o-mini. The reported rate concerns adversarial inputs classified as benign, not completed unauthorized business actions. It is a historical researcher-reported result, not a measurement of today’s service or an independently replicated enterprise outcome.

These findings are not comparable scores: one measures downstream task redirection under a document transformation; the other measures detector evasion. Together they justify testing the complete application rather than relying on a single published percentage.

Design the invoice workflow around constrained actions

Consider an illustrative architecture, not a reported customer deployment. An employee signs in through Microsoft Entra. Application code establishes the employee’s organization and permitted invoice records. Retrieval returns source identifiers and content within that scope. The assistant proposes a structured exception report. A separate service validates and stores it.

Boundary	Application control	Evidence to retain
Document enters context	Preserve source identity; scan the content actually supplied	Source version and detection disposition
Model proposes an action	Accept only defined operations and validated arguments	Proposed operation and validation result
Report leaves the application	Resolve recipients from approved records; require approval where needed	Recipient, approval, and transaction identifier
Scanner is unavailable	Hold consequential actions for retry or review	Failure reason and recovery state

Do not expose a general-purpose email tool if the business requirement is to save an internal report. If external delivery is necessary, separate report preparation from sending. Validate recipients against the authorized transaction and bind approval to the exact content and destination.

An Azure Function can implement that validation boundary, provided its identity and API permissions are appropriately scoped. The choice of compute service does not itself enforce the policy. Reject unknown fields, verify record access server-side, and prevent the model from supplying an alternate credential or tenant.

A malicious invoice might also cause the assistant to omit a late-payment penalty without invoking any tool. Include material answer manipulation in the threat model. Require important extracted facts to retain source references, and send unsupported or contradictory findings to review.

Test the deployed configuration, including benign documents

The Microsoft Foundry configuration guide, updated October 15, 2026, distinguishes detection annotations from filtering and requires guardrail assignment to the intended model or agent. A detected event can remain unfiltered. Verify behavior using a non-production deployment before changing production policy; the guide notes that assignment changes take effect immediately.

Build a paired test collection: clean invoices and matched copies containing adversarial instructions. Include quoted security training material that should remain readable, multilingual supplier notes, long documents, OCR noise, and instructions embedded in tool responses. Keep the legitimate task and expected permitted action explicit for every case.

Measure attack attempts that reach a prohibited business effect separately from attacks the scanner misses. Also measure legitimate tasks blocked, extraction accuracy, reviewer minutes per accepted report, end-to-end latency, and cost per accepted task. A security improvement that overwhelms the review queue needs an operating response.

Run a controlled scanner-timeout test and confirm that the application holds the send operation. Test a refused tool request, then verify the agent cannot retry through a broader tool. Repeat the collection when changing the model, prompt, parser, tool schema, or guardrail configuration.

Give each failure a named owner

The platform team owns guardrail assignment and configuration drift. The application team owns authorization, validated tool arguments, and safe recovery. Security owns adversarial case design and incident triage. The business owner defines which decisions require review and what makes an invoice exception materially wrong.

Record correlation identifiers and policy versions through Azure Monitor or Application Insights where integrated. Limit raw document retention according to the data policy. Responders need to reconstruct the decision and resulting action without turning telemetry into an uncontrolled copy of supplier information.

For Microsoft Foundry deployments, release readiness should include proof that a missed detection still meets an enforceable action boundary. Start with a bounded workflow, demonstrate the legitimate work it completes, and expand permissions only after the tests explain both its usefulness and its remaining failure paths.