Skip to main content

Content screening

Agents read content they did not write: web pages, emails, documents and the results of tools. An attacker can hide instructions in that content to hijack the agent. This is called prompt injection.

Content screening checks the content an agent is about to act on for prompt-injection attacks. FYAI uses the Prompt Shields feature of Microsoft Azure AI Content Safety to do it. This means some of your content is sent to Microsoft for analysis. This page says what is sent, where, what is kept, and how to switch it off.

Screening is on by default. It is an opt-out setting, not an opt-in one.

What is sent to Microsoft​

ContentSent?
The most recent message you send to an agentYes
Text results an agent receives from tools, web pages, emails and documentsYes, when screening of results is switched on for the environment. FYAI's hosted service has it on.
System promptsNo
Earlier messages in the conversationNo
The agent's own repliesNo
Tool argumentsNo
ImagesNo
GitHub Copilot agentsNo. They are not screened.
Content from an organisation or user that has opted outNo

Some size rules apply:

  • Text shorter than 12 characters is not sent.
  • An item longer than 10,000 characters is split into pieces of up to 10,000 characters, and only the first 8 pieces of an item are sent.
  • Your most recent message is sent twice in the same request, once as the user's prompt and once as a document, because Prompt Shields catches more attacks that way. It is the same text.

The request to Microsoft carries no name, email address, organisation, user or session identifier. The content itself can contain personal information, including information about other people, if you or a tool put it there.

Where it is processed​

Content is sent over HTTPS to an Azure AI Content Safety resource in the Australia East region. Australia East is outside New Zealand.

What Microsoft says about it​

FYAI relies on Microsoft's published documentation, Data, privacy, and security for Azure AI Content Safety (fetched 10 October 2026). It says:

  • no input text is stored in the model during detection, apart from customer-supplied blocklists, which FYAI does not use;
  • customer inputs are not used to train, retrain or improve the models;
  • data sent to the service stays in the region you chose and is not transmitted to other regions;
  • the Azure OpenAI abuse-monitoring process does not apply, and input data is not stored or made available for human review by Microsoft employees.

Two limits on that. The page describes Azure AI Content Safety as a whole and does not name Prompt Shields. Microsoft's region availability page lists Prompt Shields for Australia East. The page also does not state a retention period for submitted text beyond the points above. Microsoft's published documentation can change, and FYAI has not confirmed these points with Microsoft in writing.

What FYAI records​

FYAI does not keep a copy of screened content in its screening records. When screening flags something, or cannot run, FYAI logs an event that holds:

  • the source (your message or a tool result), the mode, what was done, and the name of the tool;
  • the length of the content, and the first 16 characters of its SHA-256 hash (a fingerprint, not the content);
  • the model name.

Like other FYAI log lines, these events carry the identifiers of the request they belong to, such as the organisation, project, session and agent, and the signed-in user. FYAI also logs counters of how many items were screened and how long it took, which are not broken down by organisation or user. For how long logs are kept, see section 12 of the Privacy Policy.

Screening results are held in memory for 10 minutes so that the same text is not sent twice. The original tool result stays in your conversation history, as it did before.

What happens when something is flagged​

What FYAI does with a flagged item depends on how the service is configured. It can log it only, or act on it.

Flagged contentWhen FYAI acts on it
Your messageThe agent does not process it and replies that the message was flagged by prompt-injection screening. Rephrase the request and try again.
A tool, web, email or document resultThe result is replaced with a notice that it appeared to contain instructions aimed at the AI, and the agent is told the content was blocked.

Screening is one layer of protection. It can miss attacks, and it can flag harmless text that quotes an attack, such as security documentation. If screening cannot run (for example, the service is unreachable), the request carries on and FYAI logs that screening was unavailable.

Switching it off​

Two switches exist. Screening is skipped when either the organisation or the person acting has switched it off.

LevelWhereWho can change it
OrganisationSettings → Organization → Content Screening, switch Screen for prompt injectionOrganisation Owners and Admins
YouSettings → My account → Data & Privacy, switch Screen my content for prompt injectionEach user, for their own chats only

Things to know:

  • A change takes effect within a minute. Each part of FYAI keeps the setting for up to 60 seconds.
  • Your personal switch covers chats you take part in. It does not cover scheduled and webhook runs. Those carry no user, so they follow the organisation setting alone. If you want them unscreened, an organisation Owner or Admin has to switch the organisation setting off.
  • If your organisation has switched screening off, your personal switch shows that nothing is sent whatever it is set to.
  • Switching it off means that content is not screened. Agents are not protected by this check against instructions hidden in it, and flagged items are not refused or withheld.
  • Your personal choice is stored against your account in your organisation. Deleting your account removes it, and deleting an organisation removes the organisation's setting and every user's choice in it.

API​

RequestPurpose
GET /platform-settings/content-screeningThe organisation's setting: opted_out.
PUT /platform-settings/content-screeningSet it. Body: {"opted_out": true} or {"opted_out": false}. Organisation Owners and Admins.
GET /platform-settings/content-screening/meThe caller's own setting: opted_out, and organisation_opted_out for the organisation's.
PUT /platform-settings/content-screening/meSet the caller's own choice. Same body. Any signed-in user, and it affects only the caller.

Questions​

For privacy questions about this screening, contact FYAI's Privacy Officer at [email protected].