Agent Governance on Azure, AWS, and GCP

Azure AI Content Safety provides multi-modal content moderation for text and image outputs. The service evaluates content across four severity levels (safe, low, medium, high) for categories including hate, violence, sexual content, and self-harm. For agent deployments, the critical feature is Prompt Shields, which detects and blocks both direct prompt injection attacks and indirect injection via grounded data sources. Groundedness detection validates that agent outputs are supported by their source documents, preventing hallucinated citations.

Practical configuration: Enable Prompt Shields at the Azure OpenAI resource level. Set content filter severity thresholds per category based on your agent's risk classification. For high-risk agents under EU AI Act Article 15, set all categories to block at medium severity or above. Configure groundedness detection for any agent that generates citations or references external data.

The Responsible AI Dashboard in Azure Machine Learning provides four integrated assessment components: fairness analysis (demographic parity, equalized odds), explainability (SHAP values, feature importance), error analysis (cohort-level failure patterns), and causal inference. For agent governance, this maps directly to ISO 42001 A.8.5 (system performance) and NIST MEASURE function requirements for bias and fairness testing.

Practical configuration: Run fairness assessments during the staging phase (stage gate 4) before production deployment. Define sensitive attributes relevant to your agent's domain. For HR screening agents classified as high-risk, fairness assessment is mandatory under EU AI Act Article 10 data governance requirements.

Azure Policy enforces governance rules at the subscription and resource group level. For AI agent governance, define policies that require content safety filters on all Azure OpenAI deployments, mandate diagnostic logging, restrict model access to approved endpoints, and enforce network isolation. Microsoft Entra ID manages agent identities as managed identities or service principals, implementing the NHI governance requirements from NIST GV-2.1.

Practical configuration: Assign each agent a system-assigned managed identity rather than shared credentials. Apply least-privilege RBAC roles scoped to the specific resources each agent requires. Use Azure Purview for data governance, tracking what data each agent can access and how that data is classified. This satisfies ISO 42001 A.9.2-A.9.4 data management controls.

Azure Monitor with Application Insights provides end-to-end agent observability. Configure diagnostic settings to capture all API calls, token consumption, content filter triggers, and latency metrics. Log Analytics workspace enables KQL queries for behavioral pattern analysis. For EU AI Act Article 12 compliance, configure log retention periods that match your high-risk system classification requirements.

Practical configuration: Enable diagnostic settings on all Azure OpenAI resources. Route logs to a dedicated Log Analytics workspace with immutable storage for audit compliance. Set up alert rules for anomalous patterns: sudden increases in token consumption, content filter trigger rates above baseline, or unexpected API call patterns that may indicate prompt injection attempts.

Microsoft Sentinel provides SIEM capabilities for agent incident detection and response, satisfying EU AI Act Article 62 incident reporting requirements. Configure Sentinel analytics rules to detect agent behavioral anomalies: unexpected tool invocations, privilege escalation attempts, or content filter bypass patterns. Azure Service Health monitors platform-level incidents affecting agent infrastructure. For Article 14 human oversight compliance, use Azure Logic Apps or Function Apps to implement kill switch mechanisms that halt agent execution when anomaly thresholds are breached.

Practical configuration: Create a Sentinel workspace with custom analytics rules for agent-specific threat detection. Configure action groups that trigger automated containment (disable agent managed identity, scale to zero) when critical incidents are detected. Maintain a documented escalation protocol from automated detection to human review, satisfying Article 14 intervention requirements.

Bedrock Guardrails provides five governance controls in a single configuration: content filters (hate, insults, sexual, violence, misconduct, prompt attacks), denied topics (custom topic definitions that block specific conversation areas), word filters (profanity and custom blocked terms), PII redaction (automatic detection and masking of 30+ PII types), and contextual grounding (validates output relevance and groundedness against source documents).

Practical configuration: Create a guardrail version for each agent risk tier. High-risk agents should have content filters set to HIGH strength for all categories, PII redaction enabled for all entity types, and contextual grounding thresholds set at 0.7 or higher. Attach the guardrail to the Bedrock agent association. The denied topics feature is particularly valuable for preventing agents from operating outside their declared scope, directly mapping to excessive agency prevention.

AWS CloudTrail captures every Bedrock API call, providing the audit trail required by EU AI Act Article 12 and ISO 42001 A.10.2. Configure CloudTrail to log both management events and data events for Bedrock resources. For agent governance, create dedicated IAM roles for each Bedrock agent with least-privilege permissions. Use IAM policy conditions to restrict which models, knowledge bases, and action groups each agent can access.

Practical configuration: Create an organizational CloudTrail trail with S3 bucket logging and CloudWatch Logs integration. Enable AWS Config rules to verify that all Bedrock agents have guardrails attached, that IAM roles follow least-privilege patterns, and that logging is enabled. Use Amazon Macie for data classification of any S3 buckets that agents access, satisfying ISO 42001 A.9.2 data management requirements.

Amazon EventBridge and AWS Security Hub provide agent incident detection and event correlation for EU AI Act Article 62 compliance. EventBridge captures Bedrock agent events (guardrail violations, invocation failures, throttling) and routes them to automated response workflows via Step Functions or Lambda. Security Hub aggregates findings from Config, GuardDuty, and custom agent-specific detectors into a single compliance dashboard. For Article 14 human oversight, implement Step Functions workflows with human approval tasks that gate high-risk agent actions, providing the intervention and halt mechanisms the regulation requires.

Practical configuration: Create EventBridge rules that match Bedrock guardrail violation events and route them to an SNS topic for immediate team notification, plus a Step Functions state machine for automated containment. Configure Security Hub custom actions that allow security analysts to disable agent IAM roles with a single click, satisfying Article 14 kill switch requirements.

Vertex AI safety settings configure content filtering thresholds for Gemini model calls across categories including harassment, hate speech, sexually explicit content, and dangerous content. Each category supports four threshold levels: block none, block few, block some, and block most. Model Garden provides model cards with pre-computed evaluation metrics, benchmarks, and known limitations for each available model, satisfying ISO 42001 A.8.5 system performance documentation.

Practical configuration: Set safety settings at the model endpoint level. For high-risk agents, configure all harm categories to BLOCK_MEDIUM_AND_ABOVE. Use Vertex AI evaluation pipelines to run automated assessments during the staging stage gate. Model evaluation results provide the evidence artifacts required by NIST MEASURE MS-2.6 and EU AI Act Article 15 accuracy requirements.

GCP's Workload Identity Federation provides the most flexible agent identity model, allowing agents to authenticate without long-lived service account keys. Cloud Audit Logs capture admin activity, data access, and system events across all GCP services, satisfying EU AI Act Article 12 logging requirements. The DLP API provides 150+ built-in infoType detectors for sensitive data classification and redaction.

Practical configuration: Use Workload Identity Federation for all agent service accounts. Enable Data Access audit logs for Vertex AI endpoints. Apply VPC Service Controls to create a security perimeter around agent resources, preventing data exfiltration. Run DLP inspections on any agent input/output pipelines that process PII, satisfying ISO 42001 A.9.2-A.9.4 data governance requirements.

Security Command Center (SCC) provides centralized threat detection and incident management for agent deployments, addressing EU AI Act Article 62 incident reporting requirements. SCC aggregates findings from Event Threat Detection, Cloud Audit Logs, and custom vulnerability sources into a unified security posture view. Cloud Functions triggered by SCC findings enable automated incident response: revoking agent service account permissions, disabling Vertex AI endpoints, or escalating to human operators. For Article 14 human oversight, use Cloud Tasks with human approval queues to gate high-risk agent actions.

Practical configuration: Enable SCC Premium tier for Event Threat Detection on all projects running Vertex AI agents. Create Cloud Functions that respond to critical SCC findings by automatically disabling the affected agent's service account, satisfying Article 14 kill switch requirements. Configure Pub/Sub notifications to alert the governance team within the incident response SLA.

OCI AI Services provides guardrail capabilities for generative AI models, but the content safety filters are less configurable than Bedrock Guardrails or Azure Content Safety. The service supports custom model hosting on dedicated GPU clusters with network isolation, giving enterprises control over model deployment boundaries. Content filtering covers basic categories but lacks the granular severity-level configuration available on other platforms.

Practical configuration: Deploy agents on dedicated AI clusters with network isolation via private endpoints. Configure available content safety filters at the model endpoint level. Supplement with third-party content safety (OpenAI Moderation API or custom classifiers) for categories not covered natively. Use OCI Functions to implement pre/post-processing guardrail logic around model invocations.

OCI Identity Domains with dynamic groups and policy-based access control provides agent identity management, using compartment-based isolation to enforce least-privilege access. The OCI Audit service captures all control plane and data plane API events, satisfying EU AI Act Article 12 logging requirements. Data Safe provides data masking, activity auditing, and security assessment for Oracle databases that agents access, offering governance depth unmatched by other platforms for database-centric agent architectures.

Practical configuration: Create a dedicated compartment for each agent deployment with IAM policies that restrict resource access to that compartment. Define dynamic groups that match agent compute instances by tag, then attach policies granting only the specific OCI resources each agent requires. Enable Data Safe on all Oracle databases that agents access and configure activity auditing with alert policies for anomalous query patterns.

OCI Cloud Guard monitors agent infrastructure for security misconfigurations and threat indicators, providing automated remediation through responder recipes. The Events Service captures resource state changes and routes them to OCI Functions or Notifications for automated incident response, satisfying EU AI Act Article 62 requirements. For Article 14 human oversight, use OCI Functions triggered by Cloud Guard problems to implement kill switch mechanisms that disable agent compute or revoke dynamic group policies.

Practical configuration: Enable Cloud Guard at the tenancy level with detector recipes targeting agent compartments. Create responder recipes that automatically disable agent instances when critical security problems are detected. Configure the Events Service to trigger OCI Functions for custom incident response logic and Notifications for team alerting.