Merge pull request #53984 from pablorodMS/patch-1

Patch 1 - New module11 design responsible ai security governance risk management compliance

Author: prmerger-automator[bot]

learn-pr/wwl/design-responsible-ai-security-governance-risk-management-compliance/includes/2-design-security-agents.md

@@ -38,7 +38,7 @@ Design a defense in depth approach for autonomous and semi-autonomous agents tha
 
 - Require approvals for publishing to production and for changes to high-risk capabilities (for example, actions that modify data).
 
-:::image type="content" source="../media/role-based-access-control.png" alt-text="RBAC design matrix.":::
+:::image type="content" source="../media/role-based-access-control.png" alt-text="Diagram illustrating an RBAC design matrix that maps roles to permissions and access levels across system resources.":::
 
 ## Data governance and protection
 
@@ -160,9 +160,9 @@ Design a defense in depth approach for autonomous and semi-autonomous agents tha
 
 **Govern environments and releases**
 
-- Use environment routing to separate dev/test/prod.
+- Use environment routing to separate development, testing and production.
 
-- Require peer review and approver sign-off to publish; block publishing if mandatory checks fail.
+- Require peer review and approver sign off to publish; block publishing if mandatory checks fail.
 
 **Prepare incident response**
 
@@ -220,4 +220,4 @@ Design a defense in depth approach for autonomous and semi-autonomous agents tha
 
 - [Security and governance in Microsoft Copilot Studio](/microsoft-copilot-studio/security-and-governance)
 
-- [Manage IAM for AI workloads on Azure](/training/paths/manage-iam-for-ai-workloads-on-azure/)
+- [Manage IAM for AI workloads on Azure](/training/paths/manage-iam-for-ai-workloads-on-azure/)

learn-pr/wwl/design-responsible-ai-security-governance-risk-management-compliance/includes/5-analyze-solution-ai-vulnerabilities-mitigations-prompt-manipulation.md

@@ -70,7 +70,9 @@ Models may respond unpredictably when encountering ambiguous, adversarial, or se
 
 ### Data exposure vulnerabilities
 
-#### AI systems often have access to sensitive data sources. Vulnerabilities appear when
+#### AI systems often have access to sensitive data sources. 
+
+Vulnerabilities appear when:
 
 - Prompts indirectly expose sensitive information.
 
@@ -190,4 +192,4 @@ Monitoring is central to detecting prompt attacks, unusual model behavior, and u
 
 - [Threat protection for Microsoft 365 agents](/microsoft-agent-365/admin/threat-protection)
 
-- [Evaluate AI agents with the Azure AI Foundry SDK](/azure/ai-foundry/how-to/develop/agent-evaluate-sdk)
+- [Evaluate AI agents with the Azure AI Foundry SDK](/azure/ai-foundry/how-to/develop/agent-evaluate-sdk)

learn-pr/wwl/design-responsible-ai-security-governance-risk-management-compliance/includes/6-review-solution-adherence-responsible-ai-principles.md

@@ -108,7 +108,7 @@ The following review model ensures consistency and objectivity when assessing an
 
 - Practices for documenting model lineage, data provenance, and decisions
 
-- Governance processes for review, approval, and sign-off
+- Governance processes for review, approval, and sign off
 
 ### Operational oversight and governance
 
@@ -136,4 +136,4 @@ Responsible AI is not a one-time review—it requires continuous monitoring.
 
 - [Microsoft AI tools and practices](https://www.microsoft.com/ai/tools-practices)
 
-- [Responsible AI validation for Microsoft 365 Copilot extensibility](/microsoft-365-copilot/extensibility/rai-validation)
+- [Responsible AI validation for Microsoft 365 Copilot extensibility](/microsoft-365-copilot/extensibility/rai-validation)

learn-pr/wwl/design-responsible-ai-security-governance-risk-management-compliance/includes/8-design-access-controls-ground-data-model-tune.md

@@ -52,7 +52,7 @@ Guardrails protect both users and the system by preventing unsafe or non-complia
 
 ### Examples of guardrails
 
-- Blocklists for prohibited document types
+- Block lists for prohibited document types
 
 - Sanitization pipelines removing personal data or contractual data
 

learn-pr/wwl/design-responsible-ai-security-governance-risk-management-compliance/includes/9-design-audit-trails-changes-models-data.md

@@ -72,9 +72,9 @@ Architects must ensure logs capture _metadata_, not _content_, to avoid unnecess
 
 Azure AI Foundry provides a centralized control plane for model registration, environment configuration, agent deployment, and diagnostic logging.
 
-Key audit features include:
+### Key audit features include
 
-Foundry activity logs:
+#### Foundry activity logs
 
 Track administrative actions across workspaces, registries, and deployments. Logs support export to:
 
@@ -84,9 +84,9 @@ Track administrative actions across workspaces, registries, and deployments. Log
 
 - SIEM tools (such as Microsoft Sentinel)
 
-Foundry diagnostics and tracing:
+### Foundry diagnostics and tracing
 
-Diagnostics provide traceability of execution across:
+#### Diagnostics provide traceability of execution across
 
 - Model calls
 
@@ -98,7 +98,7 @@ Diagnostics provide traceability of execution across:
 
 ## Designing audit pipelines with tracing
 
-Tracing allows architects to follow execution paths and debug generative AI behaviors. When integrated into audit trails, tracing provides:
+### Tracing allows architects to follow execution paths and debug generative AI behaviors. When integrated into audit trails, tracing provides
 
 - End-to-end visibility of model inference
 
@@ -110,7 +110,7 @@ Tracing allows architects to follow execution paths and debug generative AI beha
 
 - Detection of unusual patterns (loops, excessive token spikes, cascading failures)
 
-Recommended tracing fields include:
+### Recommended tracing fields include
 
 - Correlation ID
 
@@ -128,7 +128,7 @@ Recommended tracing fields include:
 
 ## Designing audit-ready processes
 
-Governance workflows to include:
+### Governance workflows to include
 
 - **Approval workflows** for promoting new model versions
 
@@ -142,7 +142,7 @@ Governance workflows to include:
 
 ### Retention policies
 
-Define retention requirements with Legal, Compliance, and Information Security teams.<br>Common patterns:
+#### Define retention requirements with Legal, Compliance, and Information Security teams.<br>Common patterns
 
 - 90 days for low-risk workloads
 
@@ -156,4 +156,4 @@ Define retention requirements with Legal, Compliance, and Information Security t
 
 - [Tracing a generative AI app](/training/modules/tracing-generative-ai-app/)
 
-- [Enable Azure AI Foundry diagnostics](/training/modules/azure-ai-foundry-secure-environment/enable-foundry-diagnostics)
+- [Enable Azure AI Foundry diagnostics](/training/modules/azure-ai-foundry-secure-environment/enable-foundry-diagnostics)