Map, measure, mitigate, manage
Microsoft's responsible-AI guidance is a practical, iterative four-stage process across the whole lifecycle — closely aligned to the NIST AI Risk Management Framework.
Map — identify potential harms
An upfront, use-case-specific risk assessment documenting domain-specific and general AI harms.
Measure — quantify them in outputs
Establish metrics and a baseline; track the presence and extent of harms in generated output through development.
Mitigate — reduce harms at multiple layers
Apply controls across the solution and communicate residual risks transparently.
Manage — operate responsibly
A deployment-readiness plan, operational monitoring, and governance after launch.
Four steps to a harm list
Mapping is itself a four-step sequence — collaborative, context-dependent, and ongoing.
| Step | What it involves |
|---|---|
| Identify | List possible harms (offensive/discriminatory content, factual inaccuracy, enabling illegal/unethical acts) using transparency notes, model cards, and the Responsible AI Impact Assessment. |
| Prioritize | Rank by likelihood × impact, accounting for intended use and potential for misuse. |
| Test & verify | Red-team the solution — deliberately probe for harmful outputs and record the conditions. |
| Document & share | Capture evidence, priorities, and test findings for stakeholders; keep the list updated. |
Key concept · Prioritization is context-dependent
The smart-kitchen example: an inaccurate cooking time (high likelihood, moderate impact) versus a poison recipe (low likelihood, extreme impact). Which to prioritize is a team decision involving domain experts, policy, and legal — harm identification depends on your specific services, models, fine-tuning, and grounding data.
Four layers of defense in depth
No single control is enough; apply mitigations across four layers appropriate to your risk profile.
| Layer | Techniques |
|---|---|
| Model | Choose the right model for the task; fine-tune to scope outputs. |
| Safety system | Content filters, guardrails, and Prompt Shields (abuse/injection detection). |
| System message & grounding | System prompts that set boundaries; grounding via prompt engineering and RAG. |
| User experience | Constrain inputs, validate outputs, and document capabilities, limitations, and residual harms. |
Key concept · Content filters
Content filters classify prompts and responses into four severity levels — Safe, Low, Medium, High — across five harm categories: hate & fairness, sexual, violence, self-harm, and task-adherence. Guardrails then suppress content above your threshold. The workflow is a loop: establish a baseline, apply mitigations, retest, and iterate.
Operating responsibly
The final stage sustains responsibility after launch: a deployment-readiness review, ongoing operational monitoring of live outputs, and governance procedures — plus transparent communication to users about what the system can and cannot do, and the harms mitigations may not fully address. Responsibility is a continuous practice, not a pre-launch checkbox.
Chapter 6 quiz
Fourteen questions on the four-stage process, mapping harms, the mitigation layers, and content filters. Answer first, then expand Show answer.
Part A · Multiple choice
What are the four stages of the responsible generative AI process?
- A Plan, build, test, ship
- B Map, measure, mitigate, manage
- C Sense, reason, plan, act
- D Fairness, safety, privacy, accountability
Show answer
B. They align closely with the NIST AI Risk Management Framework.
How are harms prioritized in the Map stage?
- A Alphabetically
- B By likelihood × impact
- C By cost
- D Randomly
Show answer
B. Accounting for intended use and potential for misuse.
What testing method deliberately probes a solution to produce harmful outputs?
- A Unit testing
- B Red-team testing
- C Load testing
- D A/B testing
Show answer
B — red-team testing. It establishes the realistic likelihood of harmful output.
Which mitigation layer contains content filters and Prompt Shields?
- A Model layer
- B Safety system layer
- C System message & grounding layer
- D User experience layer
Show answer
B — the safety system layer. Prompt Shields detect abuse/injection attempts.
How many severity levels do content filters classify content into?
- A Two
- B Four (Safe, Low, Medium, High)
- C Six
- D Ten
Show answer
B. Across five harm categories: hate & fairness, sexual, violence, self-harm, task-adherence.
Which layer uses RAG and system prompts to reduce harmful outputs?
- A System message & grounding layer
- B Model layer
- C Safety system layer
- D User experience layer
Show answer
A. Grounding in trusted data and behavioral system prompts constrain outputs.
Part B · True or false
Effective harm mitigation relies on a single control at one layer.
Show answer
False. It requires defense-in-depth across all four layers appropriate to the risk.
Harm identification is context-dependent and should be updated throughout the lifecycle.
Show answer
True. It depends on your services, models, fine-tuning, and grounding data — and isn't a one-time exercise.
Choosing a simpler, appropriate model can itself be a mitigation.
Show answer
True. Model selection is a model-layer mitigation — a bounded classifier may beat GPT-4 for a narrow task.
The Manage stage ends at deployment.
Show answer
False. It sustains monitoring and governance after launch — responsibility is continuous.
Part C · Short answer
Name the four mapping steps.
Show answer
Identify, prioritize, test & verify (red-team), and document & share.
Name the four mitigation layers.
Show answer
Model; safety system; system message & grounding; and user experience.
Name the five harm categories content filters classify.
Show answer
Hate & fairness, sexual, violence, self-harm, and task-adherence.
Which industry framework does the four-stage process align with?
Show answer
The NIST AI Risk Management Framework.