This rule detects creation, modification, or deletion of content filtering policies and blocklists in Microsoft Foundry (Azure AI Services). Specifically, it watches for write or delete operations to the RAI policies (`MICROSOFT.COGNITIVESERVICES/accounts/RAIPOLICIES/WRITE`/`DELETE`) and custom blocklists (`RAIBLOCKLISTS/WRITE`/`DELETE`) on an Azure AI Foundry account. Content filters govern which prompts, completions, jailbreaks, and protected-material categories are allowed or blocked. If an adversary gains control of the account, they can weaken or remove these filters, reducing guardrails and altering detections that rely on the policy’s verdicts. The rule triggers on successful administrative-log events via the Azure activity logs data stream (azure.activitylogs). Its purpose is to surface potential defense-evasion activity where changes to guardrails could enable harmful prompts or outputs. The rule maps to MITRE ATT&CK technique T1562.001 (Disable or Modify Tools) under the Defense Evasion tactic, and aligns with MITRE ATLAS for defense-evasion context. Investigation should correlate policy changes with deployments and identity activity, and verify the integrity of the Foundry configuration across related resources to ensure changes are authorized and properly logged.