We've added the ability for partners using the AI development toolkit to extend Copilot in Business Central via prompt dialogs to set both content filtering and prompt injection attack policies for their features.

Content filtering

Azure OpenAI content filtering policy is a guardrail used to flag (block) harmful content in prompt responses.

Partners using the AI development toolkit to extend Copilot in Business Central via prompt dialogs can now set their own content filtering level.

If Business Central AI resources are used, only Low and Medium are supported. Low is default, and the recommendation is to change this only if your feature is flagged as harmful in scenarios you want to support.

If your own Azure OpenAI subscription is used, a High level is available as well, although it requires an Azure OpenAI approval request. Setting the level to high is discouraged.

You can learn more about content filtering at How severity levels map to guardrail configuration.

Indirect prompt injection attacks (XPIA)

You can use indirect prompt injection attack detection tags to identify and block malicious instructions hidden in external data sources (like documents, emails, or websites) that the large language model processes. The tags work by providing a binary classification (attack detected or not). You can learn more about this in Prompt Shields in Microsoft Foundry

For untrusted inputs, AOAIChatMessage.AddXPIADetectionTags(Input) must be used when XPIA detection is enabled.

Example

The following is an example of setting content filtering and XPIA policies when extending Copilot in Business Central with the AI development toolkit—that is, when creating a prompt dialog.