How separate user input and systemprompt when invoking the Kernel Functions?

[grafanaKibana]

I have several plugins with functions where the entire prompt, including input parameters, is embedded in a single template. Here’s a sanitized but representative example of one such prompt:

# Role Definition
You are a content analysis assistant that extracts key learning objectives from educational materials.

## Processing Requirements:
- Analyze educational content and identify primary learning goals in one clear statement
- Exclude any restricted educational terms listed in {{$BLOCKEDCONCEPTS}}
- Remove specific institution names, course codes, or instructor references
- Focus solely on the learning outcome, not administrative details
- Provide empty response if no educational objective is discernible
- Maintain academic, objective language throughout

## Sample Analysis:
Input: Students spent 90 minutes exploring molecular biology concepts with Dr. Smith covering DNA replication processes for Biology 101 at State University
Output: Explored molecular biology concepts covering DNA replication processes.

Input: 45 minutes dedicated to group discussion on historical economic theories and market analysis for Economics seminar with Professor Johnson
Output: Discussed historical economic theories and market analysis.

Input: Brief 15-minute review session on statistical methods with teaching assistant regarding upcoming statistics exam
Output: Reviewed statistical methods with teaching assistant.

User Input: {{$input}}
Response:

The issue I’m encountering is that when $input contains something that should trigger Azure’s content filtering, it doesn’t, presumably because the input is injected directly into this full prompt as a variable. However, when I tested an Agent-based approach where the system prompt is passed as SystemInstructions and the user input is provided as a separate user message, content filtering works as expected.

My question:
Is there a way to achieve a similar separation of roles/messages within KernelFunction to allow Azure’s content filtering to behave correctly? Or would you recommend a different approach for addressing this issue?

[moonbox3]

Hi @grafanaKibana, are you using SK .NET or Python?

Ultimately, the prompt is getting configured as key-value pairs of {"role": , "message": }. In your text prompt above, it looks like the entire prompt, once rendered with the {{$input}} will be sent as a user message? Whereas in the agent example, the system instructions are configured as a system role versus a user role. Am I understanding that correctly?

If that is indeed the case, I'm confused why Azure's content filtering would be differentiating the messages between different roles... Perhaps I'm misunderstanding something.

Depending upon which SK language you're using, I can help direct to some samples that can allow for the use of xml tags to specify if a portion of the prompt should be user versus system.

[grafanaKibana]

Hi @moonbox3! I'm using SK .NET.

In your text prompt above, it looks like the entire prompt, once rendered with the {{$input}} will be sent as a user message? Whereas in the agent example, the system instructions are configured as a system role versus a user role. Am I understanding that correctly?

In the first case, yes, I'm simply calling the function with kernel.InvokeAsync<string>(func, kernelArguments), so the whole prompt becomes part of the user message.

If that is indeed the case, I'm confused why Azure's content filtering would be differentiating the messages between different roles... Perhaps I'm misunderstanding something.

It looks to me like Azure’s filtering evaluates the whole prompt with system and user parts when it’s sent as a single user message. If just a small part of that large prompt contains something sensitive, it seems to categorize it as low risk and allows it through.

But when I set up an Agent with a system role prompt and then send the actual user input separately like this:

var arguments = new AzureOpenAIPromptExecutionSettings
        {
            ModelId = "gpt-4o",
            Temperature = 0,
            TopP = 0.0,
            FrequencyPenalty = 0.0,
            ResponseFormat = typeof(SomeModel),
            FunctionChoiceBehavior = FunctionChoiceBehavior.Required(
                functions: GetToolsFromPlugins(kernel, RequiredPlugins),
                options: new FunctionChoiceBehaviorOptions {AllowStrictSchemaAdherence = true}),
        };

        this.ChatCompletionAgent = new ChatCompletionAgent
        {
            Kernel = kernel,
            Description = Description,
            Instructions = Instructions,
            InstructionsRole = AuthorRole.System,
            Arguments = new KernelArguments(arguments),
        };
...
var agentResponse = await this.ChatCompletionAgent
    .InvokeAsync(
        message: new ChatMessageContent(AuthorRole.User, input),
        options: agentOptions,
        cancellationToken: cancellationToken)
    .FirstAsync(cancellationToken);

It behaves as expected and filters properly.

Hope this clarification helps!

[moonbox3]

@markwallace-microsoft do you have any thoughts here?

[grafanaKibana]

@markwallace-microsoft @moonbox3 any update on this?