[Content Safety] Evolve Unified Moderate to Agent Hooks-native preview

[liamcrumm]

Summary

Adds 2026-10-15-preview to the existing POST /contentsafety/content:unifiedModerate route. Earlier API versions and the UnifiedOperations_UnifiedModerate operation ID are unchanged.

The request uses the Agent Hooks 0.1 AgentContext. The response contains a closed Agent Hooks verdict and a separate evaluation receipt.

Policy selection

The operation supports two mutually exclusive selector profiles:

• Foundry project requests use targetResourceId with the complete selectedPolicyId, selectedPolicyRevision, and selectedPolicySemanticDigest tuple.
• Named policy requests use policyId.

Foundry requests evaluate the selected Guardrail and any administrator policies bound to the target hierarchy. Each evaluated policy remains a separate receipt layer.

Evaluation receipt

The receipt includes:

• the evaluation profile, identifier, and attempt
• an RFC 8785 SHA-256 binding to the API version, request body, and selectors
• the resource ID, revision, semantic digest, activated artifact digest, decision, and role of each evaluated policy
• the evaluated intervention point and required intervention points
• the AACS host profile and authenticated producer
• public harm results when available
• the project resource ID and project incarnation for Foundry requests

The selected-policy fields replace the previous developerPolicy* selectors. manifestRegoDigest is renamed to activatedArtifactDigest. Generated-policy identity, appliedGeneration, bindingEpoch, readinessEpoch, capabilityVersion, and supportedInterventionPoints are removed from the receipt.

Eight-point authoring

The 2026-11-15-preview control-plane models support these ACS intervention bindings:

• agent_startup: $snap.agent_init (agent_init)
• input: $snap.input (user_input)
• pre_model_call: $snap.messages (messages)
• post_model_call: $snap.response (model_response)
• pre_tool_call: $snap.tool_call.args (tool_args)
• post_tool_call: $snap.tool_result.value (tool_result)
• output: $snap.output (assistant_output)
• agent_shutdown: $snap.summary (agent_summary)

The four added lifecycle and model binding models use their point-specific target and target kind. The existing 2026-09-15-preview input, output, and tool binding schemas remain unchanged. In 2026-11-15-preview, tool-name selectors remain available on the pre-tool and post-tool bindings. The RaiPolicyContentSource model includes AgentStartup, PreModelCall, PostModelCall, and AgentShutdown while retaining Prompt, Completion, PreToolCall, PostToolCall, PreRun, and PostRun.

Examples and validation support

• Adds 14 successful Unified Moderate examples covering all eight intervention points, Foundry and named-policy selection, transforms, approvals, and AACS subject roles.
• Adds semantic checks for selector combinations, exact selected-policy revisions, project and policy changes, unavailable policy layers, host capability requirements, and route availability.
• Adds mutation checks for mismatched receipt points, missing point payloads, and invalid selector combinations.
• Runs source semantic checks during TypeSpec compilation and leaves generated-file parity to the post-emission repository validation step.
• Expands the ACS policy example to include all eight intervention bindings.

[github-actions]

Next Steps to Merge

Next steps that must be taken to merge this PR:

• ❌ Your PR requires an API stewardship review as it introduces a new data-plane API version (label: data-plane-review-requested). A data-plane API reviewer is assigned from the pool and unblocks merge by applying the protected data-plane-review-signoff label. To request or expedite the offline REST API review, email azureapirbcore@microsoft.com with your PR link.
• ❌ This PR is in purview of the ARM review (label: ARMReview). This PR must get ARMSignedOff label from an ARM reviewer.
  This PR is not ready for ARM review (label: NotReadyForARMReview). This PR will not be reviewed by ARM until relevant problems are fixed. Consult the rest of this Next Steps to Merge comment for details.
  Once the blocking problems are addressed, add to the PR a comment with contents /azp run. Automation will re-evaluate this PR and if everything looks good, it will add WaitForARMFeedback label which will put this PR on the ARM review queue.
  For details of the ARM review, see aka.ms/azsdk/pr-arm-review
  

Important checks have failed. As of today they are not blocking this PR, but in near future they may.
Addressing the following failures is highly recommended:

• ⚠️ The check named Swagger BreakingChange has failed. To unblock this PR, follow the process at aka.ms/brch.

Comment generated by summarize-checks workflow run.

[github-actions]

Contributor readiness: required access

Warning

Access issues can block approvals, Azure DevOps pipelines, or labeling.

User / area	Access issue	PR impact
🔴 vishal-kadam	Azure membership not public.	Not determined.
🔴 zubairabid	Azure membership not public.	Not determined.

Internal contributors: set up / renew access. Recheck: /azsdk check-access.

Contributors with verified access (18)

Public Azure membership and repository write access verified.

User	Roles
ArcturusZhang	commit author
audunn	commit author
berndverst	commit author
catalinaperalta	commit author
cxznmhdcxz	commit author
haolingdong-msft	commit author
jhendrixMSFT	approved reviewer
kazrael2119	commit author
liamcrumm	PR author, commit author, committer
nasc17	commit author
radhikajain99	commit author
samvaity	commit author
sandeepsnairms	commit author
timotheeguerin	commit author
v-jiaodi	commit author
v-shubhamti-microsoft	commit author
vedkale	commit author
vikeshi26	commit author

Non-blocking check; fix access issues to unblock affected actions.

Last updated: 2026-10-19T17:06:22.977Z

[github-actions]

TypeSpec suppressions requiring review

Status: ❌ Approval required — 14 suppressions

This PR adds or updates the TypeSpec suppressions listed below. Suppressions are strongly discouraged — they bypass linter rules that protect API quality and consistency. Authors should avoid adding new suppressions and prefer fixing the underlying issue; reviewers should approve only when there is a clear, compelling justification and no reasonable alternative. Review each linked rule and source location, then apply typespec-suppressions-approved only if every justification is acceptable. The Status column shows ✅ once the label is applied and ❌ while approval is pending.

New suppressions (14)

Status	Rule	Source	Justification
❌	@azure-tools/typespec-azure-core/no-closed-literal-union Unions of literals should include the base scalar type to mark them as open enum.	agent-hooks.tsp#L897	These literals declare HTTP transport status codes, not an extensible body enum.
❌	@azure-tools/typespec-azure-core/no-closed-literal-union Unions of literals should include the base scalar type to mark them as open enum.	agent-hooks.tsp#L112	The external Agent Hooks 0.1 actor kind contract is closed.
❌	@azure-tools/typespec-azure-core/no-closed-literal-union Unions of literals should include the base scalar type to mark them as open enum.	agent-hooks.tsp#L126	Agent Hooks 0.1 requires allow, deny or transform; an unknown decision must fail closed.
❌	@azure-tools/typespec-azure-core/no-closed-literal-union Unions of literals should include the base scalar type to mark them as open enum.	agent-hooks.tsp#L747	The October hosted transport admits exactly the Foundry-project and named-policy profiles. Local in-process integrations do not call this route.
❌	@azure-tools/typespec-azure-core/no-closed-literal-union Unions of literals should include the base scalar type to mark them as open enum.	agent-hooks.tsp#L84	The external Agent Hooks 0.1 input role contract is closed.

Showing 5 of 14 suppressions. See the full analysis log for the complete list.

For an overview of TypeSpec linting rules click here.
For a mapping from ARM lintdiff rules to corresponding TypeSpec linting rules click here.

💬 Have feedback on the TypeSpec suppression flow? Let us know.

[github-actions]

API Change Check

APIView identified API level changes in this PR and created the following API reviews

Language	API Review for Package
Python	azure-ai-contentsafety
C#	Azure.AI.ContentSafety
Java	com.azure:azure-ai-contentsafety
JavaScript	@azure/ai-content-safety
Go	sdk/resourcemanager/cognitiveservices/armcognitiveservices
Python	azure-mgmt-cognitiveservices
Java	com.azure.resourcemanager:azure-resourcemanager-cognitiveservices
JavaScript	@azure/arm-cognitiveservices
C#	Azure.ResourceManager.CognitiveServices

---

Comment generated by After APIView workflow run.

[github-actions]

Data-Plane API Review

Automated advisory review by Copilot. This is one non-deterministic pass over a
narrow semantic scope and does not replace complete human API review.

No findings in the reviewed scope.

Not reviewed: deterministic compiler/linter concerns, naming and
documentation quality, grey-area design questions, runtime behavior, SDK
customizations, and unchanged API surface.

🔍 Automated data-plane API review by Data-Plane API Review. Advisory only.

[Joel Hendrix (jhendrixMSFT)]

Note that when you merge these changes to main you'll want to separate your ARM and data-plane content into separate PRs.

[fmabroukmsft]

Comment 3 — Green .NET validation contains a failed build

Content Safety client.tsp:6

The .NET SDK validation check is green, but its generation log contains Build FAILED. PreviewOperationsTests.cs:43–61 fails with CS0246/CS0103 because the regenerated surface no longer contains UnifiedModerateConfig, UnifiedModerateSource, UnifiedModerateResult, UnifiedModerateVerdict, and AcsDecision.

The package is subsequently classified as result [warning], so the successful overall check conceals a real SDK test-project compilation failure associated with switching the client to the October preview.