Enforce visual policy rules such as watermarks, prohibited symbols, brand requirements, and inappropriate content detection
AI-103 › Unit 3: Implement computer vision solutions › Implement responsible AI for multimodal content › Enforce visual policy rules such as watermarks, prohibited symbols, brand requirements, and inappropriate content detection
Enforce visual policy rules such as watermarks, prohibited symbols, brand requirements, and inappropriate content detection
Organisational visual policy is broader than the platform's safety taxonomy, and that mismatch is the whole objective. Harm categories cover four things and cannot be extended. Everything else — a prohibited symbol list, brand mark rules, provenance marking, licensed-character avoidance — is assembled from separate instruments, each with its own boundary.
Why This Matters
Policy is a portfolio, not a setting. Four different mechanisms cover four different requirement shapes, and a scenario usually mixes them.
Provenance travels with the file; a log does not. Content Credentials, implementing C2PA, are embedded in the media itself.
Some rules can only be checked by a model you train or configure. A prohibited symbol is not a term, not a harm category, and not protected material.
Prerequisites
- The four harm categories, severity levels, and the image trim.
- That blocklists match terms and are applied as input, output, or both filters.
- Content Credentials as C2PA provenance metadata.
- The Custom Vision retirement and AutoML as the detection path.
Learning Objectives
By the end of this lesson you will be able to:
- Map a visual policy rule to the instrument that can enforce it.
- Apply Content Credentials for provenance and disclosure.
- Distinguish protected material from brand and IP policy.
- Build a custom classifier path for organisation-specific rules.
- Place human review where automation cannot decide.
Building Blocks
The instruments.
| Instrument | Covers | Boundary |
|---|---|---|
| Harm categories | Hate and Fairness, Sexual, Violence, Self-Harm | Fixed — cannot be extended |
| Blocklists | Enumerable terms, as input, output, or both | Text only — cannot see pixels |
| Protected material | Known copyrighted content in output (text and code, GA, On) | Not brand compliance, not provenance |
| Content Credentials | Provenance — that content is AI-generated and by which model | Records origin; does not detect anything |
| Custom classifier | Your own visual rules | Needs labelled data (AutoML) or a schema (Content Understanding) |
Model-level generation policy. Sora 2 "blocks all IP and photorealistic content", rejects copyrighted characters and copyrighted music, cannot generate real people including public figures, rejects input images with faces of humans, and produces only content suitable for audiences under 18. These are model behaviours, not configuration.
The classifier paths. Azure Machine Learning AutoML trains "custom image classification and object detection models", with a no-code studio experience — the migration target now that Custom Vision must be left by 25 September 2026 and retires 25 September 2028. Content Understanding offers a classify field with an enum, requiring no training data.
Verification. Confidence scores from 0 to 1 and grounding to source regions, enabled with estimateFieldSourceAndConfidence, support routing rather than reviewing everything.
Two ways to build a custom visual check
| Attribute | ||
|---|---|---|
| Needs training data | Yes — labelled images | No — a schema and an |
| Returns | Labels and bounding boxes | A category per field |
| Locates instances | Yes | No |
| Setup effort | Higher — labelling and training | Lower |
| Fits | Counting, locating, precise detection | Presence, category, triage at scale |
Deep Dive
Mapping the rule to the instrument
Visual policies arrive as a list, and each line resolves to one instrument.
"No graphic violence." — a harm category, handled by the content filter at a threshold you set, defaulting to medium on prompts and completions.
"Never show these twelve prohibited symbols." — not a harm category, and not a blocklist, because a blocklist matches terms and a symbol is not a term. This needs a classifier.
"Generated images must be identifiable as AI-generated downstream." — Content Credentials, embedded so they travel with the file.
"Do not reproduce licensed characters." — protected material addresses known copyrighted content in output, and on the generation side Sora 2 blocks all IP and rejects copyrighted characters and music as model behaviour.
"Our logo must appear at the correct size and clear space." — a brand rule requiring measurement of a specific mark. A classifier can flag presence; correctness of placement generally needs review or purpose-built checking.
The pattern to internalise: harm categories are fixed, blocklists are textual, protected material is about known copyrighted works, and anything organisation-specific and visual needs a classifier you build.
Assembling visual policy enforcement
Split the policy line by line
Harmful content, IP, provenance, brand, and organisation-specific rules are different instruments.
Provenance: Content Credentials
Provenance answers a question no detector can: where did this file come from?
Content Credentials implement the C2PA standard, attaching signed metadata to the media recording that it was AI-generated and by which model. Being embedded, it travels with the file — surviving download, forwarding, and publication outside your tenancy.
The alternatives a question will offer all fail for a specific reason. A log entry stays in your subscription and does not accompany the artefact. A visible watermark is a visual mark, not machine-readable signed metadata, and can be cropped. Protected material detection is about known copyrighted content appearing in output — a different question entirely.
So whenever the requirement mentions downstream consumers, disclosure, or provable origin, the answer is Content Credentials. And note what it is not: it records origin, it does not detect anything, so it is never the answer to "find images that break our rules".
Building the organisation-specific check
Most real visual policy is organisation-specific, and there are two routes.
Azure Machine Learning AutoML trains custom classification and object detection models on your labelled images, offering "a code-first experience, as well as a no-code studio web experience similar to Custom Vision". It is the right choice when instances must be located or counted — every occurrence of a prohibited symbol, with positions. Its cost is that it needs labelled training data.
Content Understanding's classify method returns a category from an enum with no training data, and pairs naturally with a generate field carrying an explanation. It is the right choice for presence and triage at scale: does this image appear to contain a prohibited mark, what category is it, is it compliant. It does not produce bounding boxes.
The scalable pattern combines them: classify broadly to narrow the set, then run precise detection only on flagged assets. That keeps the expensive path small — the same shape as the video hybrid, for the same reason.
And the deadline governs both: Custom Vision must be left by 25 September 2026 and retires 25 September 2028, so it is never the recommendation.
Where the checks belong in the pipeline
Placement matters as much as instrument choice.
At generation. Prompt and output moderation both run, and model-level policy applies — Sora 2's blocking of IP and photorealistic content, real people, and faces in input images. Attach Content Credentials here, because provenance is cheapest to add at the moment of creation.
At ingestion. Third-party images should be classified on the way in, before they reach a model or an index. This is also where text extraction and screening belong, for the injection reason covered separately.
Before publication. The last gate, where organisation-specific classifiers and human review sit. This is the only place a brand rule can be meaningfully enforced, because it concerns the finished asset.
Two things to carry across all three: confidence-based routing, so review effort lands where scores are low, and the fact that x-policy-id is unavailable for image input, so per-caller policy variation means separate deployments rather than a per-request header.
Worked Examples
Example 1 — a partner's prohibited symbol list, plus disclosure. A partner requires that twelve named symbols never appear in generated images, and that recipients can verify the images are AI-generated.
Two instruments. The symbols need a classifier — AutoML if occurrences must be located, or a Content Understanding classify field for presence — because the harm taxonomy cannot be extended and a blocklist matches terms, not pixels. Disclosure needs Content Credentials (C2PA), embedded so they travel with the file; a log entry stays behind.
Example 2 — licensed characters. A studio must ensure generated video never depicts licensed characters.
Largely handled at the model: Sora 2 "blocks all IP and photorealistic content" and rejects copyrighted characters and copyrighted music — model behaviour, not a setting to configure. Protected material detection addresses known copyrighted content in output as a complementary control. Neither is a brand-compliance check, and neither records provenance.
Example 3 — logo usage rules. Marketing wants automated enforcement of logo size, clear space, and approved variants.
Automate the triage: a classifier flags images where the logo is present and apparently non-conforming, with confidence scores routing the uncertain ones. Decide with human review or a purpose-built geometric check — placement and clear space are measurements against a specification, not a perception category, and treating a classifier's output as the ruling will produce both false approvals and false rejections.
Visual Explanations
Rule to instrument:
Where each check runs:
Common Mistakes
Trying to add a category to the harm taxonomy. It is fixed.
Using a blocklist for a symbol or logo. Blocklists match terms.
Choosing a log entry for provenance. Content Credentials travel with the file.
Confusing protected material with brand compliance.
Expecting Content Credentials to detect anything. They record origin.
Recommending Custom Vision. Transition by 25 September 2026.
Treating a classifier score as a brand ruling. Triage, then decide.
Assuming AutoML is available without labelled data.
Trying to vary image policy per request. x-policy-id is unavailable for image input.
Practice Exercises
- Map each to an instrument: graphic violence; a prohibited symbol; AI-generated disclosure; a licensed character.
- Why is a blocklist wrong for a prohibited symbol, and what is right?
- What does Content Credentials do and not do?
- When would you choose AutoML over Content Understanding
classify, and what does it cost? - Why is logo-usage compliance a review workflow rather than a classifier output?
▶Answers
- Graphic violence → a harm category with a threshold. Prohibited symbol → a classifier you build (AutoML or Content Understanding
classify). AI-generated disclosure → Content Credentials (C2PA). Licensed character → protected material plus model-level blocking, since Sora 2 "blocks all IP" and rejects copyrighted characters and music. - Because a blocklist matches terms — it is a text control applied as an input filter, output filter, or both — and a symbol is not a term. The harm taxonomy also cannot be extended. The right instrument is a classifier: AutoML detection if occurrences must be located, or a Content Understanding
classifyfield for presence. - It records provenance — signed C2PA metadata embedded in the media stating the content is AI-generated and by which model, travelling with the file through distribution. It does not detect anything, so it never answers "find images that break our rules".
- When instances must be located or counted — bounding boxes per occurrence. It costs labelled training data, which
classifydoes not require.classifyreturns a category with no training but no positions. - Because "is the logo present?" is a perception question a classifier handles, while approved variant, minimum size, clear space, approved background are measurements against a specification — closer to a linting rule. Automate triage with confidence routing; let a human or a purpose-built geometric check decide.
Summary & Concept Map
Visual policy enforcement is assembled from four instruments with hard boundaries. The harm categories are fixed and not extensible, covering hate, sexual, violence, and self-harm at a threshold you set. Blocklists match terms and therefore cannot see pixels at all. Protected material detects known copyrighted content in output, complemented on the generation side by model-level policy — Sora 2 blocking all IP and photorealistic content, rejecting copyrighted characters and music, real people, and faces in input images. Content Credentials (C2PA) record provenance, embedded so they travel with the file, and detect nothing. Everything organisation-specific — prohibited symbols, brand marks — needs a classifier you build: AutoML where instances must be located (at the cost of labelled data), or a Content Understanding classify field for presence and triage. Place checks at generation, ingestion, and before publication, route on confidence, and leave brand correctness to review.
Sources and freshness
Written against current Microsoft Learn documentation for the AI-103 skills measured (16 April 2026), reviewed 2026-08-20. Microsoft Learn controls every changing product contract — availability, preview status, quotas, limits, regional support, naming, and retirement dates all move independently of this lesson. Where a scenario turns on a specific number or a GA/preview boundary, confirm it against the product's own page before relying on it.