--- title: APIM Policy Patterns for AI Governance: Part 2 – Content... description: A practical walkthrough of APIM policy patterns for governing AI traffic, covering content safety, PII handling, response redaction and model entitlement.... canonical: https://daily.dev/posts/apim-policy-patterns-for-ai-governance-part-2-content-safety-model-control-1ax3zo01e twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: APIM Policy Patterns for AI Governance: Part 2 – Content Safety & Model Control | daily.dev og:description: A practical walkthrough of APIM policy patterns for governing AI traffic, covering content safety, PII handling, response redaction and model entitlement.... og:url: https://daily.dev/posts/apim-policy-patterns-for-ai-governance-part-2-content-safety-model-control-1ax3zo01e og:image: https://api.daily.dev/og/posts/1aX3Zo01E.png og:image:alt: APIM Policy Patterns for AI Governance: Part 2 – Content Safety & Model Control og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # APIM Policy Patterns for AI Governance: Part 2 – Content Safety & Model Control **[Thomas Thornton](https://daily.dev/sources/thomasthornton)** · 11 min read · 0 upvotes · 0 comments ## Summary A practical walkthrough of APIM policy patterns for governing AI traffic, covering content safety, PII handling, response redaction and model entitlement. Recommends starting with APIM's built-in llm-content-safety policy for harm categories and Prompt Shields rather than custom regex, treating PII detection as a separate concern best handled by Azure AI Language's Text PII service, and using stable model aliases tied to validated Entra ID claims (not caller-controlled headers) for model authorisation. Distinguishes Azure Policy's platform-level model deployment approval from APIM's runtime consumer entitlement, and lists a set of failure paths and edge cases (streaming violations, body-stream consumption, unsupported set-variable types, Consumption-tier documentation inconsistencies) to test before promoting such policies to production. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I block harmful content and prompt injection attacks in Azure API Management for an AI gateway? Use APIM's built-in llm-content-safety policy rather than writing custom regex or calling Azure AI Content Safety manually. Configure category thresholds for Hate, SelfHarm, Sexual, and Violence using EightSeverityLevels, set shield-prompt="true" to catch prompt attacks, and enforce-on-completions="true" to also check model responses. Reference the Content Safety resource through a configured backend-id, not a hardcoded URL. _Teams wiring up AI gateway guardrails can track new APIM policy patterns like this on daily.dev._ ### Does Azure APIM's llm-content-safety policy detect personally identifiable information like credit card numbers? No, llm-content-safety only covers four harm categories (Hate, SelfHarm, Sexual, Violence) plus prompt-attack detection via Prompt Shields; it provides no PII detection. For real PII coverage, Azure Text PII in Azure Language can detect and redact sensitive entities from unstructured text. A deterministic regex check inside APIM can work only for simple, strongly structured patterns like card-like digit sequences, not general PII. _Developers designing data-loss-prevention layers for AI APIs can follow this kind of gateway guidance on daily.dev._ ### How should I authorize which AI model a consumer is allowed to call in an API gateway? Base the decision on an identity APIM has already validated, such as an Entra ID token claim like ai_tier, rather than a caller-controlled header such as X-Consumer-Tier. Validate the Azure AD token, extract the claim, and check it against the requested model alias before routing, returning a 403 with a model_not_authorised error if the tier doesn't permit that model. _Platform engineers enforcing model access rules can keep up with APIM entitlement patterns via daily.dev._ ## Similar posts on daily.dev - [From Azure Policy to APIM: Implementing Azure AI Guardrails](https://daily.dev/posts/from-azure-policy-to-apim-implementing-azure-ai-guardrails-jsddgfd4m) · Thomas Thornton · 0 upvotes · 0 comments - [APIM Policy Patterns for AI Governance: Part 1 – Rate Limits, Token Quotas & Observability](https://daily.dev/posts/apim-policy-patterns-for-ai-governance-part-1-rate-limits-token-quotas-observability-3kredwnuo) · Thomas Thornton · 1 upvotes · 0 comments - [Enforce Content Policies at the Gateway with AI Gateway Guardrails](https://daily.dev/posts/enforce-content-policies-at-the-gateway-with-ai-gateway-guardrails-ffe7yn6va) · mlflow · 0 upvotes · 0 comments --- Tags: [#azure](https://daily.dev/tags/azure), [#authentication](https://daily.dev/tags/authentication), [#api-gateway](https://daily.dev/tags/api-gateway), [#ai-governance](https://daily.dev/tags/ai-governance) [View this post on daily.dev](https://daily.dev/posts/apim-policy-patterns-for-ai-governance-part-2-content-safety-model-control-1ax3zo01e) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"APIM Policy Patterns for AI Governance: Part 2 – Content Safety & Model Control","url":"https://daily.dev/posts/apim-policy-patterns-for-ai-governance-part-2-content-safety-model-control-1ax3zo01e","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/apim-policy-patterns-for-ai-governance-part-2-content-safety-model-control-1ax3zo01e"},"datePublished":"2026-09-01T12:02:18.278Z","dateModified":"2026-09-01T12:02:49.867Z","description":"A practical walkthrough of APIM policy patterns for governing AI traffic, covering content safety, PII handling, response redaction and model entitlement....","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Thomas Thornton","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Thomas Thornton","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/03d58f5ec1004427824a8381b15027e8","url":"https://daily.dev/sources/thomasthornton"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/apim-policy-patterns-for-ai-governance-part-2-content-safety-model-control-1ax3zo01e","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"azure,authentication,api-gateway,ai-governance","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Thomas Thornton","item":"https://daily.dev/sources/thomasthornton"},{"@type":"ListItem","position":3,"name":"APIM Policy Patterns for AI Governance: Part 2 – Content Safety & Model Control"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/apim-policy-patterns-for-ai-governance-part-2-content-safety-model-control-1ax3zo01e#faq","mainEntity":[{"@type":"Question","name":"How do I block harmful content and prompt injection attacks in Azure API Management for an AI gateway?","acceptedAnswer":{"@type":"Answer","text":"Use APIM's built-in llm-content-safety policy rather than writing custom regex or calling Azure AI Content Safety manually. Configure category thresholds for Hate, SelfHarm, Sexual, and Violence using EightSeverityLevels, set shield-prompt=\"true\" to catch prompt attacks, and enforce-on-completions=\"true\" to also check model responses. Reference the Content Safety resource through a configured backend-id, not a hardcoded URL. Teams wiring up AI gateway guardrails can track new APIM policy patterns like this on daily.dev."}},{"@type":"Question","name":"Does Azure APIM's llm-content-safety policy detect personally identifiable information like credit card numbers?","acceptedAnswer":{"@type":"Answer","text":"No, llm-content-safety only covers four harm categories (Hate, SelfHarm, Sexual, Violence) plus prompt-attack detection via Prompt Shields; it provides no PII detection. For real PII coverage, Azure Text PII in Azure Language can detect and redact sensitive entities from unstructured text. A deterministic regex check inside APIM can work only for simple, strongly structured patterns like card-like digit sequences, not general PII. Developers designing data-loss-prevention layers for AI APIs can follow this kind of gateway guidance on daily.dev."}},{"@type":"Question","name":"How should I authorize which AI model a consumer is allowed to call in an API gateway?","acceptedAnswer":{"@type":"Answer","text":"Base the decision on an identity APIM has already validated, such as an Entra ID token claim like ai_tier, rather than a caller-controlled header such as X-Consumer-Tier. Validate the Azure AD token, extract the claim, and check it against the requested model alias before routing, returning a 403 with a model_not_authorised error if the tier doesn't permit that model. Platform engineers enforcing model access rules can keep up with APIM entitlement patterns via daily.dev."}}]} ```