Content Filter & Moderation Errors Across All AI Providers — 2026 Guide
Content filter false positives cost teams more than any other quiet failure mode — legitimate customer messages silently refused, retry loops burning budget, users abandoning to competitors. Every provider handles moderation differently, with different appeals and different override options. This is the cross-provider directory: every content filter pattern grouped by provider and mechanism.
Content filter false positives cost teams more than any other quiet failure mode we've documented. A pharmacy chatbot triggers medical safety filters discussing drug interactions. A legal AI triggers violence filters citing case precedent. A security research tool triggers hacking filters explaining exploit patterns. Every provider handles moderation differently — some let you turn it off (with approval), some don't. This page is the cross-provider directory: every content filter, moderation, and refusal pattern we've documented across every provider, IDE tool, and gateway, grouped so you can find your specific error in seconds.
For the editorial angle on why content filter false positives are one of the most underreported failure modes in production AI, see The AI Errors Nobody Talks About — content filter refusals section. For related failure modes, see the Rate Limits, Authentication, Context Window, and Timeouts category hubs.
2026 content filter mechanisms at a glance
Every provider has a different philosophy on content moderation. Some enforce broad implicit filters (Claude); others give you fine-grained per-category control (Gemini). Here's the 2026 landscape at a glance.
| Provider | Default state | Configurability | Categories | Override method |
|---|---|---|---|---|
| Anthropic Claude | On (implicit) | Not configurable | Undocumented (broad safety) | System prompt refinement |
| OpenAI (Chat Completions) | On + Moderation API optional | Limited via safety settings | 11 categories (sexual, violence, hate, self-harm, etc.) | Prompt engineering only |
| OpenAI Moderation API | Standalone endpoint | Threshold-based | Same 11 categories | You decide action from scores |
| Google Gemini | On (4 harm categories) | Highly configurable via safetySettings | HARASSMENT, HATE_SPEECH, SEXUALLY_EXPLICIT, DANGEROUS_CONTENT | BLOCK_NONE per category (Vertex) |
| AWS Bedrock Guardrails | Opt-in (must be applied) | Highly configurable | Custom policies + built-in | Don't apply guardrail on request |
| Azure OpenAI | On (4 severity levels) | Configurable per deployment | 4 categories (hate, self-harm, sexual, violence) | Content Filter config in Foundry |
| Azure OpenAI (Enterprise) | Configurable filters | Full override with approval | All + protected material + jailbreak | Filter config + Modified Content Filter approval |
| Portkey Guardrails | Opt-in per config | 50+ built-in + integrations | PII, prompt injection, jailbreak, custom | Config-level enable/disable |
| LiteLLM | Callback-based | Custom callbacks | Whatever you implement | Callback logic |
Anthropic Claude
Claude's content filtering is implicit — you cannot turn it off or configure category thresholds. Refusals appear as regular assistant messages (not error codes) with content explaining the refusal, or as stop_reason: 'refusal' in the API response. This makes false positives harder to detect programmatically than in providers with explicit content-filter response fields.
- stop_reason: refusal — model declined requestNot an error code, appears as response
- Copyrighted content detected refusalSong lyrics, book excerpts, etc
- Prompt injection suspected — response degradedModel behaves cautiously not refuses
- System prompt cannot override safety guidelinesNo 'disable safety' option
OpenAI
OpenAI's chat completion returns finish_reason: 'content_filter' on triggered refusals. Separately, the Moderation API is a standalone endpoint (free) that returns category scores — you decide the action. Combining pre-request moderation with post-generation filtering is the pattern for high-stakes applications like customer support.
- finish_reason: content_filter — response blockedPost-generation filtering
- Moderation API flagged input safety categoriesPre-request check with category scores
- Safety violation error on input promptPrompt rejected before generation
- Content filter jailbreak attempt detectedPrompt injection style content
Google Gemini
Gemini has the most explicit safety controls of any major provider. Four harm categories (HARASSMENT, HATE_SPEECH, SEXUALLY_EXPLICIT, DANGEROUS_CONTENT) each with configurable thresholds (BLOCK_NONE, BLOCK_LOW, BLOCK_MEDIUM, BLOCK_HIGH). BLOCK_NONE requires Vertex AI (not AI Studio) and enterprise approval for some categories.
- finish_reason: SAFETY — blocked at medium thresholdResponse blocked mid-generation
- Prompt blocked — block_reason: SAFETYPrompt rejected before generation
- safetySettings BLOCK_NONE not allowed on AI StudioMove to Vertex AI for BLOCK_NONE
- HARM_CATEGORY_DANGEROUS_CONTENT false positive on cookingKitchen chemistry, food safety topics
AWS Bedrock Guardrails
Bedrock Guardrails is opt-in — the underlying model has its own filters (Claude-on-Bedrock behaves the same as direct Claude), and Guardrails adds AWS-managed policies on top. Highly configurable: denied topics, sensitive information (PII), content filters, word filters, contextual grounding checks. Enterprise-focused with detailed audit logs.
Azure OpenAI
Azure OpenAI has the most enterprise-friendly content filtering — 4 severity levels (Safe, Low, Medium, High) per category, configurable per deployment. Modified content filter approval is available for regulated industries (medical, security research) — a formal process to request lower thresholds with justification.
- Content filter severity triggeredContent flagged at configured threshold
- Jailbreak detection — Prompt ShieldPrompt injection defense fires
- Protected material detected — response blockedCopyrighted code or text patterns
- Modified content filter requires approvalFor regulated industries needing lower thresholds
Content filtering at other layers of the stack
Content moderation isn't only a provider-layer concern. IDE tools have their own code-generation policies, gateways can add moderation layers (Portkey has 50+ built-in guardrails), frameworks integrate post-generation filters. Each layer can block content the underlying provider would have allowed.
IDE Tools
IDE tools inherit their underlying model's content filtering — Cursor with Claude has Claude's refusal patterns; Copilot with GPT-5.6 has OpenAI's. Additionally, tools have their own policies around code generation (no malware, no exploits). Refusals in IDE tools often appear as failed edits or partial completions rather than clear error messages.
Gateway Layer
Gateways add their own content moderation layer above the underlying provider — this is Portkey's biggest differentiator (50+ built-in guardrails). LiteLLM supports moderation via callback hooks. OpenRouter passes through provider filters unchanged. Gateway-layer moderation runs before the request reaches the provider, saving cost on rejected requests.
Framework Layer
Frameworks integrate with provider filters via response inspection — LangChain's guardrails wrappers, LangGraph's interrupt-on-safety-flag, LlamaIndex's response synthesizer post-processing. Framework-layer moderation is typically post-generation (inspect the model output before returning to user), adding a second check on top of provider filters.