Module 11 of 11
Design responsible AI security, governance, risk management, and compliance
Apply the Responsible AI principles, defend against prompt manipulation, and design access control, residency, and audit.
Exam questions Q101–Q110 11 units on Learn
Open module 11 on Microsoft Learn ↗ Watch the episode (41 min)
Why this module matters
This module carries disproportionate exam weight because its content threads through every other module. You must know the six Responsible AI principles by name, recognise which one a scenario threatens, and design layered controls.
Prompt injection deserves particular attention: it is the signature AI-specific vulnerability, and the mitigation pattern is precise.
The one big ideaTreat retrieved content as data, never as instructions — and enforce the user's own permissions at retrieval time. Those two rules prevent the majority of AI-specific incidents.
What Microsoft Learn covers
Units in this module, as published on Microsoft Learn:
- Introduction
- Design security agents for Microsoft clouds
- Design governance models for AI agents
- Design model security for responsible AI
- Analyze AI vulnerabilities and mitigations for prompt manipulation
- Review solution adherence to Responsible AI principles
- Validate data residency and movement compliance
- Design access controls for grounding data and model tuning
- Design audit trails for changes to models and data
- Module assessment
- Summary
Watch this module
Microsoft Learn publishes a free video course for AB-100 on YouTube. This module is covered by one 41 min episode. An instructor walking through the module is often faster than reading it twice.
Key concepts and definitions
| Responsible AI principles | Fairness · Reliability and safety · Privacy and security · Inclusiveness · Transparency · Accountability. Learn all six in order. |
| Fairness | Comparable quality of service across groups. Threatened when an agent performs measurably better for one demographic than another. |
| Transparency | Users know they are interacting with AI, understand its limitations and data use, and can reach a human. |
| Accountability | A named human owner is answerable for the system's behaviour and outcomes. |
| Impact assessment | Documented intended uses, stakeholders, potential harms, mitigations, and residual risk, with an accountable owner. |
| Prompt injection | Untrusted content smuggling instructions into the model's context to hijack behaviour. The defining AI-specific attack. |
| Permission trimming | Enforcing existing identity and permissions at retrieval time, so users only ever see content they are already entitled to. |
| Data Loss Prevention (DLP) | Power Platform policies restricting which connectors and data sources may be combined, preventing unsanctioned data flows. |
| Microsoft Purview | Supports compliance across Copilot interactions — eDiscovery, retention, audit, and information protection. |
| Microsoft Entra ID | Identity provider for authentication, conditional access, and least-privilege authorisation. |
| Data residency and movement | Where data is stored and processed, and the rules governing cross-border transfer. |
| Audit trail | A durable record of changes to models, prompts, knowledge, and data, and of consequential agent decisions. |
| Defence in depth | Layered controls: identity and least privilege; DLP and classification; content safety filters; monitoring and audit; incident response. |
Design guidance
Mitigating prompt injection
- Treat retrieved content as data, never as instructions. This is the core of the answer.
- Isolate system instructions from retrieved context so untrusted text cannot override them.
- Validate tool inputs and constrain what actions the agent is permitted to take.
- Apply least privilege so a successful injection has minimal reach.
- Increasing token limits, removing citations, or trusting the source do nothing — they are distractors.
Access, residency, and audit
- Enforce permissions at retrieval time through delegated access and permission trimming. A disclaimer in the response is not a control.
- Design access controls for grounding data and for model tuning inputs — tuning data leaks just as readily as retrieval data.
- Validate residency and cross-border movement against regional regulation before choosing a deployment topology.
- Maintain audit trails for changes to models, prompts, knowledge, and data, plus logs of consequential decisions.
High-impact and regulated decisions
- Require human review or approval, decision logging, explainability, and periodic audit.
- Never rely solely on the model provider's assurances, and never remove logging in the name of privacy.
- Disclose AI involvement, limitations, and the route to a human clearly and proactively — to all users, not only administrators and not only on request.
Good practice vs. anti-pattern
Do
- Enforce user permissions at retrieval time.
- Isolate instructions from untrusted retrieved content.
- Apply DLP policies and data classification.
- Keep audit trails for model, prompt, and data changes.
Avoid
- Rely on a disclaimer instead of a permission control.
- Let retrieved content dictate tool calls.
- Hide that the user is talking to AI.
- Disable logging to protect privacy.
Exam traps to watch for
TrapThe six principles are fairness, reliability and safety, privacy and security, inclusiveness, transparency, accountability. Confidentiality/integrity/availability is the CIA triad, not Responsible AI.
TrapUnequal performance across demographic groups is a fairness issue, not transparency or reliability.
TrapDLP restricts which connectors and data sources may be combined. It does not reduce token use, assign licences, or improve accuracy.
TrapThe compliance capability for eDiscovery and retention over Copilot interactions is Microsoft Purview — not Power BI, Azure DevOps, or Fabric.
TrapDefence in depth means layers. A single content filter, a firewall alone, or passwords alone are all wrong answers.
Readiness checklist
You are ready to move on when you can do all of these without notes.
- Recite the six Responsible AI principles.
- Match a scenario symptom to the principle it threatens.
- Give the four-part mitigation for prompt injection.
- Explain permission trimming and why a disclaimer is not equivalent.
- List the layers of a defence-in-depth design for an enterprise agent.