The five scopes, one by one

Lesson 2 of 5 in The GenAI Security Scoping Matrix: Know What You’re Securing.

Start on the buying side. In Scope 1 — Consumer app, your organization consumes a public third-party genAI service, free or paid, often consumer-grade and never designed for enterprise use. AWS’s example: an employee asks a public genAI chat app for marketing-campaign ideas. Ours: a developer pastes a stack trace into a free chatbot to decode an error, or a recruiter drafts a job ad in one. You do not own or see the training data or the model, you cannot modify or augment it, and the provider’s terms of service are the only contract in the room. Scope 1 security is therefore mostly usage policy: deciding what your people may type into someone else’s box.

Scope 2 — Enterprise app looks similar on screen but differs in law: a third-party enterprise application with genAI features embedded, under a real business relationship. AWS’s example is a scheduling app that drafts meeting agendas; think also of a CRM that writes follow-up emails from deal notes, or an office suite whose copilot summarizes your documents. You still cannot touch the model — but enterprise terms and conditions can add the protections consumer ToS never will: data-handling commitments, training opt-outs, audit rights.

Now the building side. In Scope 3 — Pre-trained models, you build your own application on a third-party foundation model through an API. AWS’s example: a customer-support chatbot using RAG over your own data with the Anthropic Claude model via Amazon Bedrock APIs. Ours: an internal HR-policy assistant that retrieves from your handbook, or a contract summarizer calling a hosted model. The crucial property: your data flows through the model at inference but never changes it. The model stays the provider’s; the application, the retrieval layer, and every data flow around the model are yours.

Scope 4 — Fine-tuned models crosses a line: you refine a third-party foundation model with business-specific data, producing a new, specialized model. AWS’s examples: aligning patient-record summaries in an EHR system to medical style and terminology, and a generator for marketing materials specific to your products. Ours: an insurer tuning a model on years of adjuster notes so claims summaries come out in house style. Your data is now in the weights — a fact with governance consequences the next lesson dwells on.

Scope 5 — Self-trained models is full ownership: you build and train a generative model from scratch on data you own or acquire. AWS’s example: a custom video-generation model licensed to media companies. Ours: a bank training a domain language model on decades of proprietary research. Nobody upstream shares responsibility for the model — its data, its behavior, and its terms of use are all yours to govern.

What you take on as the scope number rises

  1. Scope 1: Consumer app

    You own nothing but your usage. The provider owns the model, the data, and the terms. Your lever: policy on what employees may submit.

  2. Scope 2: Enterprise app

    Still the vendor’s model — but now you hold negotiated enterprise terms: data-handling commitments, training opt-outs, support SLAs.

  3. Scope 3: Pre-trained model via API

    You own the application and every data flow around the model — retrieval, filtering, identity. The model itself remains the provider’s, unmodified.

  4. Scope 4: Fine-tuned model

    You now own a model artifact whose weights contain your business data. Its classification, access rules, and lifecycle are your problem.

  5. Scope 5: Self-trained model

    You own every aspect: training data, weights, behavior, and — if others use it — the terms of service your lawyers must write.

Interactive sorting exercise: Sort each workload into its region of the ownership spectrum.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.